diff options
| author | emaste <emaste@FreeBSD.org> | 2015-01-16 15:16:19 +0000 |
|---|---|---|
| committer | emaste <emaste@FreeBSD.org> | 2015-01-16 15:16:19 +0000 |
| commit | 10cd749e1511b75822667f5153ea7aec74193b9f (patch) | |
| tree | 3bb845f27ad2e16d5aeaaf139777a38bc59c3be9 /contrib/elftoolchain | |
| parent | d8422ac82c56192ee2879a1c0c6697be7640d46a (diff) | |
| download | FreeBSD-src-10cd749e1511b75822667f5153ea7aec74193b9f.zip FreeBSD-src-10cd749e1511b75822667f5153ea7aec74193b9f.tar.gz | |
Verify that section header offset is not past EOF
MFC After: 1 week
Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'contrib/elftoolchain')
| -rw-r--r-- | contrib/elftoolchain/libelf/elf_scn.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/contrib/elftoolchain/libelf/elf_scn.c b/contrib/elftoolchain/libelf/elf_scn.c index 209e2ef..9a9c816 100644 --- a/contrib/elftoolchain/libelf/elf_scn.c +++ b/contrib/elftoolchain/libelf/elf_scn.c @@ -60,7 +60,8 @@ _libelf_load_section_headers(Elf *e, void *ehdr) assert((e->e_flags & LIBELF_F_SHDRS_LOADED) == 0); #define CHECK_EHDR(E,EH) do { \ - if (fsz != (EH)->e_shentsize || \ + if (shoff > e->e_rawsize || \ + fsz != (EH)->e_shentsize || \ shnum > SIZE_MAX / fsz || \ fsz * shnum > e->e_rawsize - shoff) { \ LIBELF_SET_ERROR(HEADER, 0); \ |
