From c8a0273dd506b8d2dfcf8412d34459d3bb8a18db Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Sat, 13 Dec 2014 22:23:45 +0100 Subject: [PATCH] libdwfl: Make sure elf_getdata_rawchunk size_t doesn't overflow find_dynsym. Signed-off-by: Mark Wielaard --- libdwfl/ChangeLog | 5 +++++ libdwfl/dwfl_module_getdwarf.c | 10 +++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog index c49558fc..36585765 100644 --- a/libdwfl/ChangeLog +++ b/libdwfl/ChangeLog @@ -1,3 +1,8 @@ +2014-12-13 Mark Wielaard + + * dwfl_module_getdwarf.c (find_dynsym): elf_getdata_rawchunk takes + a size_t, make sure it doesn't overflow. + 2014-12-13 Mark Wielaard * cu.c (cudie_offset): Make sure Dwarf_Off difference doesn't diff --git a/libdwfl/dwfl_module_getdwarf.c b/libdwfl/dwfl_module_getdwarf.c index c2e9e591..ab9bd48d 100644 --- a/libdwfl/dwfl_module_getdwarf.c +++ b/libdwfl/dwfl_module_getdwarf.c @@ -768,7 +768,15 @@ find_dynsym (Dwfl_Module *mod) * sizeof (Elf32_Word) * header->maskwords)); - data = elf_getdata_rawchunk (mod->main.elf, buckets_at, + // elf_getdata_rawchunk takes a size_t, make sure it + // doesn't overflow. +#if SIZE_MAX <= UINT32_MAX + if (nbuckets > SIZE_MAX / sizeof (Elf32_Word)) + data = NULL; + else +#endif + data + = elf_getdata_rawchunk (mod->main.elf, buckets_at, nbuckets * sizeof (Elf32_Word), ELF_T_WORD); if (data != NULL && symndx < nbuckets)