readelf: Fix overflow check in handle_sysv_hash64.

Since all values are 64bit, not 32bit as in other hashes, we need to
explicitly check for overflow.

Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/src/ChangeLog b/src/ChangeLog
index d3828d9cbafef50a51e884d400049efb3eb2f033..0819c1e1cd25d0abf1fbdfac65b99e50a585bc72 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2014-11-30  Mark Wielaard  <mjw@redhat.com>
+
+       * readelf.c (handle_sysv_hash64): Fix overflow check.
+
 2014-11-28  Mark Wielaard  <mjw@redhat.com>
 
        * readelf.c (handle_relocs_rel): Don't reuse destshdr to store

diff --git a/src/readelf.c b/src/readelf.c
index 69ae5d0d0455b73945a169e64b8a18660879ba80..89b17547022172ea2958030ada63970d259ee3cb 100644 (file)
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -3055,8 +3055,10 @@ handle_sysv_hash64 (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr, size_t shstrndx)
   Elf64_Xword nbucket = ((Elf64_Xword *) data->d_buf)[0];
   Elf64_Xword nchain = ((Elf64_Xword *) data->d_buf)[1];
 
-  uint64_t used_buf = (2ULL + nchain + nbucket) * sizeof (Elf64_Xword);
-  if (used_buf > data->d_size)
+  uint64_t maxwords = data->d_size / sizeof (Elf64_Xword);
+  if (maxwords < 2
+      || maxwords - 2 < nbucket
+      || maxwords - 2 - nbucket < nchain)
     goto invalid_data;
 
   Elf64_Xword *bucket = &((Elf64_Xword *) data->d_buf)[2];