diff options
| author | emaste <emaste@FreeBSD.org> | 2015-01-23 04:07:07 +0000 |
|---|---|---|
| committer | emaste <emaste@FreeBSD.org> | 2015-01-23 04:07:07 +0000 |
| commit | 227bb2b2ea01be5c73785d6cd7fd96443e7c0bb0 (patch) | |
| tree | 2daa2fb7a8a7a2ccc8ff65592528be559bf43e38 /lib | |
| parent | 23ccab912a903dc5714f61e29d179fb7a18525d0 (diff) | |
| download | FreeBSD-src-227bb2b2ea01be5c73785d6cd7fd96443e7c0bb0.zip FreeBSD-src-227bb2b2ea01be5c73785d6cd7fd96443e7c0bb0.tar.gz | |
libelf: Improve ELF header validation
Avoid integer overflow and reading past EOF.
MFC of r276427, r276443, r277249 from contrib/elftoolchain.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libelf/elf_scn.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/lib/libelf/elf_scn.c b/lib/libelf/elf_scn.c index 2eefca1..5b2b3c7 100644 --- a/lib/libelf/elf_scn.c +++ b/lib/libelf/elf_scn.c @@ -31,6 +31,7 @@ __FBSDID("$FreeBSD$"); #include <errno.h> #include <gelf.h> #include <libelf.h> +#include <stdint.h> #include <stdlib.h> #include "_libelf.h" @@ -55,8 +56,10 @@ _libelf_load_scn(Elf *e, void *ehdr) assert((e->e_flags & LIBELF_F_SHDRS_LOADED) == 0); #define CHECK_EHDR(E,EH) do { \ - if (fsz != (EH)->e_shentsize || \ - shoff + fsz * shnum > e->e_rawsize) { \ + if (shoff > e->e_rawsize || \ + fsz != (EH)->e_shentsize || \ + shnum > SIZE_MAX / fsz || \ + fsz * shnum > e->e_rawsize - shoff) { \ LIBELF_SET_ERROR(HEADER, 0); \ return (0); \ } \ |
