Fix possible crash in note conversion.

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 38d352de31e61a6ca6206e4d4faa9253642301a9..be259e620852bc076c9fd4db52033cf43f145103 100644 (file)
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -12,6 +12,11 @@
        * Makefile.am: Use USE_LOCKS instead of USE_TLS.
        * elf_error.c: Always use __thread.  Remove all !USE_TLS code.
 
+2009-01-04  Roland McGrath  <roland@redhat.com>
+
+       * note_xlate.h (elf_cvt_note): Don't examine a size too small to
+       container a note header.
+
 2008-12-11  Roland McGrath  <roland@redhat.com>
 
        * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Handle

diff --git a/libelf/note_xlate.h b/libelf/note_xlate.h
index 6e8b78c6cdd57bf6259ea12b1deb923b4dc79a9d..a72fe8688cc250f4f93c3717cac9572ba1b51fe2 100644 (file)
--- a/libelf/note_xlate.h
+++ b/libelf/note_xlate.h
@@ -1,5 +1,5 @@
 /* Conversion functions for notes.
-   Copyright (C) 2007 Red Hat, Inc.
+   Copyright (C) 2007, 2009 Red Hat, Inc.
    This file is part of Red Hat elfutils.
 
    Red Hat elfutils is free software; you can redistribute it and/or modify
@@ -52,7 +52,7 @@ elf_cvt_note (void *dest, const void *src, size_t len, int encode)
 {
   assert (sizeof (Elf32_Nhdr) == sizeof (Elf64_Nhdr));
 
-  while (len > 0)
+  while (len >= sizeof (Elf32_Nhdr))
     {
       (1 ? Elf32_cvt_Nhdr : Elf64_cvt_Nhdr) (dest, src, sizeof (Elf32_Nhdr),
                                             encode);