From: Mark Wielaard <mjw@redhat.com>
To: elfutils-devel@lists.fedorahosted.org
Subject: [COMMITTED] readelf: Sanity check CIE unit_length and augmentationlen in debug_frame.
Date: Fri, 14 Nov 2014 21:45:42 +0100 [thread overview]
Message-ID: <1415997942-1929-1-git-send-email-mjw@redhat.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 2058 bytes --]
Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
src/ChangeLog | 5 +++++
src/readelf.c | 17 ++++++++++++++++-
2 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/src/ChangeLog b/src/ChangeLog
index be1d55f..7561041 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,10 @@
2014-11-14 Mark Wielaard <mjw@redhat.com>
+ * readelf.c (print_debug_frame_section): Sanity Check CIE
+ unit_length and augmentationlen.
+
+2014-11-14 Mark Wielaard <mjw@redhat.com>
+
* readelf.c (handle_versym): Check def == NULL before use.
2014-11-08 Mark Wielaard <mjw@redhat.com>
diff --git a/src/readelf.c b/src/readelf.c
index 243e16e..065ee1c 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -5332,6 +5332,10 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
continue;
}
+ Dwarf_Word maxsize = dataend - readp;
+ if (unlikely (unit_length > maxsize))
+ goto invalid_data;
+
unsigned int ptr_size = ehdr->e_ident[EI_CLASS] == ELFCLASS32 ? 4 : 8;
ptrdiff_t start = readp - (unsigned char *) data->d_buf;
@@ -5413,7 +5417,11 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
get_uleb128 (augmentationlen, readp);
if (augmentationlen > (size_t) (dataend - readp))
- error (1, 0, gettext ("invalid augmentation length"));
+ {
+ error (0, 0, gettext ("invalid augmentation length"));
+ readp = cieend;
+ continue;
+ }
const char *hdr = "Augmentation data:";
const char *cp = augmentation + 1;
@@ -5561,6 +5569,13 @@ print_debug_frame_section (Dwfl_Module *dwflmod, Ebl *ebl, GElf_Ehdr *ehdr,
unsigned int augmentationlen;
get_uleb128 (augmentationlen, readp);
+ if (augmentationlen > (size_t) (dataend - readp))
+ {
+ error (0, 0, gettext ("invalid augmentation length"));
+ readp = cieend;
+ continue;
+ }
+
if (augmentationlen > 0)
{
const char *hdr = "Augmentation data:";
--
1.8.3.1
reply other threads:[~2014-11-14 20:45 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1415997942-1929-1-git-send-email-mjw@redhat.com \
--to=mjw@redhat.com \
--cc=elfutils-devel@lists.fedorahosted.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).