From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gnu.wildebeest.org (gnu.wildebeest.org [45.83.234.184]) by sourceware.org (Postfix) with ESMTPS id 4AA8F3858400 for ; Sun, 19 Dec 2021 19:56:32 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 4AA8F3858400 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=klomp.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=klomp.org Received: from reform (deer0x12.wildebeest.org [172.31.17.148]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gnu.wildebeest.org (Postfix) with ESMTPSA id BCE5C302FBA8; Sun, 19 Dec 2021 20:56:29 +0100 (CET) Received: by reform (Postfix, from userid 1000) id 794B42E8374A; Sun, 19 Dec 2021 20:56:29 +0100 (CET) From: Mark Wielaard To: elfutils-devel@sourceware.org Cc: Mark Wielaard Subject: [PATCH] libdwfl: Make sure dyn_filesz has a sane size Date: Sun, 19 Dec 2021 20:56:27 +0100 Message-Id: <20211219195627.948388-1-mark@klomp.org> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-10.0 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Dec 2021 19:56:33 -0000 In dwfl_segment_report_module dyn_filesz should be able to hold at least one Elf_Dyn element, and not be larger than possible. Signed-off-by: Mark Wielaard --- libdwfl/ChangeLog | 6 ++++++ libdwfl/dwfl_segment_report_module.c | 3 +++ 2 files changed, 9 insertions(+) diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog index 38e2bdaa..1f83576d 100644 --- a/libdwfl/ChangeLog +++ b/libdwfl/ChangeLog @@ -1,3 +1,9 @@ +2021-12-08 Mark Wielaard + + * dwfl_segment_report_module.c (dwfl_segment_report_module): Make sure + that dyn_filesz can contain at least one Elf_Dyn and isn't larger than + possible. + 2021-12-08 Mark Wielaard * dwfl_segment_report_module.c (dwfl_segment_report_module): Make sure diff --git a/libdwfl/dwfl_segment_report_module.c b/libdwfl/dwfl_segment_report_module.c index 840d6f44..78c70795 100644 --- a/libdwfl/dwfl_segment_report_module.c +++ b/libdwfl/dwfl_segment_report_module.c @@ -787,6 +787,9 @@ dwfl_segment_report_module (Dwfl *dwfl, int ndx, const char *name, if (dyn_data_size != 0) dyn_filesz = dyn_data_size; + if ((dyn_filesz / dyn_entsize) == 0 + || dyn_filesz > (SIZE_MAX / dyn_entsize)) + goto out; void *dyns = malloc (dyn_filesz); Elf32_Dyn *d32 = dyns; Elf64_Dyn *d64 = dyns; -- 2.30.2