* [COMMITTED] gelf_getnote: Check padding overflow.
@ 2014-11-16 10:34 Mark Wielaard
0 siblings, 0 replies; only message in thread
From: Mark Wielaard @ 2014-11-16 10:34 UTC (permalink / raw)
To: elfutils-devel
[-- Attachment #1: Type: text/plain, Size: 1746 bytes --]
Since ELF notes need to be properly aligned they can include padding.
Make sure the padding itself and the padding calculation doesn't overflow.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
libelf/ChangeLog | 4 ++++
libelf/gelf_getnote.c | 9 +++++++--
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 4886093..beb431f 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,5 +1,9 @@
2014-11-16 Mark Wielaard <mjw@redhat.com>
+ * gelf_getnote.c (gelf_getnote): Check padding overflow.
+
+2014-11-16 Mark Wielaard <mjw@redhat.com>
+
* elf_getdata.c (__libelf_set_rawdata_wrlock): Declare offset, size
and align as Elf64_Off and Elf64_Xword not size_t.
diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c
index 8bb78c1..7dc8215 100644
--- a/libelf/gelf_getnote.c
+++ b/libelf/gelf_getnote.c
@@ -73,16 +73,21 @@ gelf_getnote (data, offset, result, name_offset, desc_offset)
const GElf_Nhdr *n = data->d_buf + offset;
offset += sizeof *n;
+ /* Include padding. Check below for overflow. */
GElf_Word namesz = NOTE_ALIGN (n->n_namesz);
GElf_Word descsz = NOTE_ALIGN (n->n_descsz);
- if (unlikely (data->d_size - offset < namesz))
+ if (unlikely (offset > data->d_size
+ || data->d_size - offset < namesz
+ || (namesz == 0 && n->n_namesz != 0)))
offset = 0;
else
{
*name_offset = offset;
offset += namesz;
- if (unlikely (data->d_size - offset < descsz))
+ if (unlikely (offset > data->d_size
+ || data->d_size - offset < descsz
+ || (descsz == 0 && n->n_descsz != 0)))
offset = 0;
else
{
--
1.8.3.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-11-16 10:34 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-11-16 10:34 [COMMITTED] gelf_getnote: Check padding overflow Mark Wielaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).