openharmony/third_party_elfutils
1
0
Fork 0
mirror of https://github.com/openharmony/third_party_elfutils.git synced 2026-07-01 06:41:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

libelf: Add n_namesz offset overflow check to gelf_get_note.

Browse Source 
During fuzzing of the new xlate_notes testcase I noticed that
gelf_get_note didn't check whether the n_namesz of a note was
too big. This could lead to offset wrapping around. Causing an
infinite loop going over all ELF notes. Fix by adding an overflow
check before updating offset.

Signed-off-by: Mark Wielaard <mark@klomp.org>
This commit is contained in:
Mark Wielaard
2019-05-01 15:52:24 +02:00
parent 1d8f5d30a9
commit 4628b0ea03
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libelf/ChangeLog
+5
View File
@@ -1,3 +1,8 @@
2019-05-01 Mark Wielaard <mark@klomp.org>
* gelf_getnote.c (gelf_getnote): Check n_namesz doesn't overflow
offset.
2019-04-30 Mark Wielaard <mark@klomp.org>
* note_xlate.h (elf_cvt_note): Indicate we only translated the note
libelf/gelf_getnote.c
+3 -2
View File
@@ -80,11 +80,12 @@ gelf_getnote (Elf_Data *data, size_t offset, GElf_Nhdr *result,
the offset, after adding the namesz, and include padding
in descsz to get to the end. */
*name_offset = offset;
offset += n->n_namesz;
if (offset > data->d_size)
if (n->n_namesz > data->d_size
|| offset > data->d_size - n->n_namesz)
offset = 0;
else
{
offset += n->n_namesz;
/* Include padding. Check below for overflow. */
GElf_Word descsz = (data->d_type == ELF_T_NHDR8
? NOTE_ALIGN8 (n->n_descsz)