From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============4626963361658226700==" MIME-Version: 1.0 From: Mark Wielaard To: elfutils-devel@lists.fedorahosted.org Subject: [COMMITTED] gelf_getnote: Check padding overflow. Date: Sun, 16 Nov 2014 11:34:19 +0100 Message-ID: <1416134059-8734-1-git-send-email-mjw@redhat.com> --===============4626963361658226700== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Since ELF notes need to be properly aligned they can include padding. Make sure the padding itself and the padding calculation doesn't overflow. Signed-off-by: Mark Wielaard --- libelf/ChangeLog | 4 ++++ libelf/gelf_getnote.c | 9 +++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 4886093..beb431f 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,5 +1,9 @@ 2014-11-16 Mark Wielaard = + * gelf_getnote.c (gelf_getnote): Check padding overflow. + +2014-11-16 Mark Wielaard + * elf_getdata.c (__libelf_set_rawdata_wrlock): Declare offset, size and align as Elf64_Off and Elf64_Xword not size_t. = diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c index 8bb78c1..7dc8215 100644 --- a/libelf/gelf_getnote.c +++ b/libelf/gelf_getnote.c @@ -73,16 +73,21 @@ gelf_getnote (data, offset, result, name_offset, desc_o= ffset) const GElf_Nhdr *n =3D data->d_buf + offset; offset +=3D sizeof *n; = + /* Include padding. Check below for overflow. */ GElf_Word namesz =3D NOTE_ALIGN (n->n_namesz); GElf_Word descsz =3D NOTE_ALIGN (n->n_descsz); = - if (unlikely (data->d_size - offset < namesz)) + if (unlikely (offset > data->d_size + || data->d_size - offset < namesz + || (namesz =3D=3D 0 && n->n_namesz !=3D 0))) offset =3D 0; else { *name_offset =3D offset; offset +=3D namesz; - if (unlikely (data->d_size - offset < descsz)) + if (unlikely (offset > data->d_size + || data->d_size - offset < descsz + || (descsz =3D=3D 0 && n->n_descsz !=3D 0))) offset =3D 0; else { -- = 1.8.3.1 --===============4626963361658226700==--