* [PATCH] elflint: Add sanity checks to check_attributes.
@ 2015-05-06 15:42 Mark Wielaard
0 siblings, 0 replies; 2+ messages in thread
From: Mark Wielaard @ 2015-05-06 15:42 UTC (permalink / raw)
To: elfutils-devel
[-- Attachment #1: Type: text/plain, Size: 1728 bytes --]
This is similar to commit 9644aa for readelf print_attributes.
Bail out when the vendor name isn't terminated and add overflow check
for subsection_len.
Note that readelf does handle non-gnu attributes, while elflint doesn't.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
src/ChangeLog | 2 ++
src/elflint.c | 6 ++++--
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/ChangeLog b/src/ChangeLog
index 93f4aba..089fe93 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -4,6 +4,8 @@
shift too big.
(check_verdef): Use Elf64_Word for shdr->sh_info cnt.
(check_verneed): Likewise.
+ (check_attributes): Break when vendor name isn't terminated.
+ Add overflow check for subsection_len.
2015-05-05 Mark Wielaard <mjw@redhat.com>
diff --git a/src/elflint.c b/src/elflint.c
index 4e53646..df476a1 100644
--- a/src/elflint.c
+++ b/src/elflint.c
@@ -3423,7 +3423,7 @@ section [%2d] '%s': offset %zu: invalid length in attribute section\n"),
ERROR (gettext ("\
section [%2d] '%s': offset %zu: unterminated vendor name string\n"),
idx, section_name (ebl, idx), pos (p));
- continue;
+ break;
}
++q;
@@ -3466,7 +3466,9 @@ section [%2d] '%s': offset %zu: zero length field in attribute subsection\n"),
if (MY_ELFDATA != ehdr->e_ident[EI_DATA])
CONVERT (subsection_len);
- if (p - chunk < (ptrdiff_t) subsection_len)
+ /* Don't overflow, ptrdiff_t might be 32bits, but signed. */
+ if (p - chunk < (ptrdiff_t) subsection_len
+ || subsection_len >= (uint32_t) PTRDIFF_MAX)
{
ERROR (gettext ("\
section [%2d] '%s': offset %zu: invalid length in attribute subsection\n"),
--
2.1.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] elflint: Add sanity checks to check_attributes.
@ 2015-05-12 14:49 Mark Wielaard
0 siblings, 0 replies; 2+ messages in thread
From: Mark Wielaard @ 2015-05-12 14:49 UTC (permalink / raw)
To: elfutils-devel
[-- Attachment #1: Type: text/plain, Size: 240 bytes --]
On Wed, 2015-05-06 at 17:42 +0200, Mark Wielaard wrote:
> This is similar to commit 9644aa for readelf print_attributes.
> Bail out when the vendor name isn't terminated and add overflow check
> for subsection_len.
Pushed to master.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-05-12 14:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-05-06 15:42 [PATCH] elflint: Add sanity checks to check_attributes Mark Wielaard
2015-05-12 14:49 Mark Wielaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).