diff options
| author | delphij <delphij@FreeBSD.org> | 2014-12-11 06:00:53 +0000 |
|---|---|---|
| committer | delphij <delphij@FreeBSD.org> | 2014-12-11 06:00:53 +0000 |
| commit | 2e5be0fdd11aef0d2cb0d88c71946b953019f313 (patch) | |
| tree | b244166ac6ad22aa3a3644030c1820586c4b9fc6 /src/elfclass.h | |
| parent | 7893a3c5449c71b45d7eadfe0af1d36c4b36103d (diff) | |
| download | FreeBSD-src-2e5be0fdd11aef0d2cb0d88c71946b953019f313.zip FreeBSD-src-2e5be0fdd11aef0d2cb0d88c71946b953019f313.tar.gz | |
Vendor import of file 5.21.
Diffstat (limited to 'src/elfclass.h')
| -rw-r--r-- | src/elfclass.h | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/src/elfclass.h b/src/elfclass.h index 010958a..e144d11 100644 --- a/src/elfclass.h +++ b/src/elfclass.h @@ -35,10 +35,12 @@ switch (type) { #ifdef ELFCORE case ET_CORE: + phnum = elf_getu16(swap, elfhdr.e_phnum); + if (phnum > ms->elf_phnum_max) + return toomany(ms, "program", phnum); flags |= FLAGS_IS_CORE; if (dophn_core(ms, clazz, swap, fd, - (off_t)elf_getu(swap, elfhdr.e_phoff), - elf_getu16(swap, elfhdr.e_phnum), + (off_t)elf_getu(swap, elfhdr.e_phoff), phnum, (size_t)elf_getu16(swap, elfhdr.e_phentsize), fsize, &flags) == -1) return -1; @@ -46,18 +48,24 @@ #endif case ET_EXEC: case ET_DYN: + phnum = elf_getu16(swap, elfhdr.e_phnum); + if (phnum > ms->elf_phnum_max) + return toomany(ms, "program", phnum); + shnum = elf_getu16(swap, elfhdr.e_shnum); + if (shnum > ms->elf_shnum_max) + return toomany(ms, "section", shnum); if (dophn_exec(ms, clazz, swap, fd, - (off_t)elf_getu(swap, elfhdr.e_phoff), - elf_getu16(swap, elfhdr.e_phnum), + (off_t)elf_getu(swap, elfhdr.e_phoff), phnum, (size_t)elf_getu16(swap, elfhdr.e_phentsize), - fsize, &flags, elf_getu16(swap, elfhdr.e_shnum)) - == -1) + fsize, &flags, shnum) == -1) return -1; /*FALLTHROUGH*/ case ET_REL: + shnum = elf_getu16(swap, elfhdr.e_shnum); + if (shnum > ms->elf_shnum_max) + return toomany(ms, "section", shnum); if (doshn(ms, clazz, swap, fd, - (off_t)elf_getu(swap, elfhdr.e_shoff), - elf_getu16(swap, elfhdr.e_shnum), + (off_t)elf_getu(swap, elfhdr.e_shoff), shnum, (size_t)elf_getu16(swap, elfhdr.e_shentsize), fsize, &flags, elf_getu16(swap, elfhdr.e_machine), (int)elf_getu16(swap, elfhdr.e_shstrndx)) == -1) |
