* [COMMITTED] libelf: Make sure we have at least a full ELF header available.
@ 2020-12-16 10:05 Mark Wielaard
0 siblings, 0 replies; only message in thread
From: Mark Wielaard @ 2020-12-16 10:05 UTC (permalink / raw)
To: elfutils-devel; +Cc: Mark Wielaard
When elf_memory is called we could get a slightly too small image
that doesn't contain a full ELF header (but does contain at least
the e_ident values). Require the full header before even validating
the rest of the ELF header fields.
https://sourceware.org/bugzilla/show_bug.cgi?id=27076
Signed-off-by: Mark Wielaard <mark@klomp.org>
---
libelf/ChangeLog | 4 ++++
libelf/elf_begin.c | 7 +++++++
2 files changed, 11 insertions(+)
diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 41727fbd..a280a262 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,7 @@
+2020-12-15 Mark Wielaard <mark@klomp.org>
+
+ * elf_begin.c (get_shnum): Make sure the full Ehdr is available.
+
2020-12-12 Dmitry V. Levin <ldv@altlinux.org>
* common.h: Fix spelling typo in comment.
diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c
index 43828c9a..32648c15 100644
--- a/libelf/elf_begin.c
+++ b/libelf/elf_begin.c
@@ -88,6 +88,13 @@ get_shnum (void *map_address, unsigned char *e_ident, int fildes,
} ehdr_mem;
bool is32 = e_ident[EI_CLASS] == ELFCLASS32;
+ if ((is32 && maxsize < sizeof (Elf32_Ehdr))
+ || (!is32 && maxsize < sizeof (Elf64_Ehdr)))
+ {
+ __libelf_seterrno (ELF_E_INVALID_ELF);
+ return (size_t) -1l;
+ }
+
/* Make the ELF header available. */
if (e_ident[EI_DATA] == MY_ELFDATA
&& (ALLOW_UNALIGNED
--
2.18.4
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-12-16 10:05 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-16 10:05 [COMMITTED] libelf: Make sure we have at least a full ELF header available Mark Wielaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).