[Bug libelf/24085] An Out of Memory problem was discovered in function in read_long_names in elf_begin.c in libelf

["mark at klomp dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=24085

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mark at klomp dot org

--- Comment #2 from Mark Wielaard <mark at klomp dot org> ---
I am not sure this is a real issue. The read_long_names code does the
following:

  newp = (char *) malloc (len);
  if (newp != NULL)

And if it is newp NULL is returned, which is then interpreted as an error:

              /* No long name table although it is reference.  The archive is
                 broken.  */
              __libelf_seterrno (ELF_E_INVALID_ARCHIVE);
              return -1;

There are also checks that no more data is read than there is in the file, so
if len is really big and malloc still succeeds that is also flagged as a
corrupt file.

So, yeah, a malloc call might fail on an invalid file, but nothing bad will
happen.

If you do feel it is an issue. We could move up the size checks, so no malloc
is done at all if len is really weird and we know the malloc would probably
fail anyway.

-- 
You are receiving this mail because:
You are on the CC list for the bug.