diff options
| author | emaste <emaste@FreeBSD.org> | 2015-05-21 19:16:28 +0000 |
|---|---|---|
| committer | emaste <emaste@FreeBSD.org> | 2015-05-21 19:16:28 +0000 |
| commit | a071e4290a81cb63f83074be202b5ace6eb49b6b (patch) | |
| tree | fc7be80509585355add03e5a701af31e1f1bb000 /usr.sbin | |
| parent | 51f0c42396fa0db8a54387238ba3b4db7721d481 (diff) | |
| download | FreeBSD-src-a071e4290a81cb63f83074be202b5ace6eb49b6b.zip FreeBSD-src-a071e4290a81cb63f83074be202b5ace6eb49b6b.tar.gz | |
MFC r282144: crunchide: add basic string table sanity checks
Reported by: Coverity Scan
CID: 978805, 980919
Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/crunch/crunchide/exec_elf32.c | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/usr.sbin/crunch/crunchide/exec_elf32.c b/usr.sbin/crunch/crunchide/exec_elf32.c index 8813497..288edf69 100644 --- a/usr.sbin/crunch/crunchide/exec_elf32.c +++ b/usr.sbin/crunch/crunchide/exec_elf32.c @@ -342,11 +342,14 @@ ELFNAMEEND(hide)(int fd, const char *fn) */ /* load section string table for debug use */ - if ((shstrtabp = xmalloc(xewtoh(shstrtabshdr->sh_size), fn, - "section string table")) == NULL) + if ((size = xewtoh(shstrtabshdr->sh_size)) == 0) + goto bad; + if ((shstrtabp = xmalloc(size, fn, "section string table")) == NULL) goto bad; if ((size_t)xreadatoff(fd, shstrtabp, xewtoh(shstrtabshdr->sh_offset), - xewtoh(shstrtabshdr->sh_size), fn) != xewtoh(shstrtabshdr->sh_size)) + size, fn) != size) + goto bad; + if (shstrtabp[size - 1] != '\0') goto bad; /* we need symtab, strtab, and everything behind strtab */ @@ -367,7 +370,8 @@ ELFNAMEEND(hide)(int fd, const char *fn) strtabidx = i; if (layoutp[i].shdr == symtabshdr || i >= strtabidx) { off = xewtoh(layoutp[i].shdr->sh_offset); - size = xewtoh(layoutp[i].shdr->sh_size); + if ((size = xewtoh(layoutp[i].shdr->sh_size)) == 0) + goto bad; layoutp[i].bufp = xmalloc(size, fn, shstrtabp + xewtoh(layoutp[i].shdr->sh_name)); if (layoutp[i].bufp == NULL) @@ -377,10 +381,13 @@ ELFNAMEEND(hide)(int fd, const char *fn) goto bad; /* set symbol table and string table */ - if (layoutp[i].shdr == symtabshdr) + if (layoutp[i].shdr == symtabshdr) { symtabp = layoutp[i].bufp; - else if (layoutp[i].shdr == strtabshdr) + } else if (layoutp[i].shdr == strtabshdr) { strtabp = layoutp[i].bufp; + if (strtabp[size - 1] != '\0') + goto bad; + } } } |
