readelf: Robustify print_phdr program interpreter printing.

Check phdr->p_filesz and make sure interpreter string is zero terminated
before calling printf.

Reported-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/src/ChangeLog b/src/ChangeLog
index 134ad9053725d6374d5d7eb2bff81e9ff505917b..ad3b2b1356c4874ad8a3676dca4f72fc412f8740 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2014-02-07  Mark Wielaard  <mjw@redhat.com>
+
+       * readelf.c (print_phdr): Check phdr->p_filesz and make sure
+       interpreter string is zero terminated before calling printf.
+
 2014-01-22  Mark Wielaard  <mjw@redhat.com>
 
        * Makefile.am (nm_no_Wformat): Removed.

diff --git a/src/readelf.c b/src/readelf.c
index 5c5ad3d837ed87a369b809839b1ee3e8ea53a84a..fb9546359ec57e0dc728607a4851e3b97567e3aa 100644 (file)
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -1191,7 +1191,10 @@ print_phdr (Ebl *ebl, GElf_Ehdr *ehdr)
          size_t maxsize;
          char *filedata = elf_rawfile (ebl->elf, &maxsize);
 
-         if (filedata != NULL && phdr->p_offset < maxsize)
+         if (filedata != NULL && phdr->p_offset < maxsize
+             && phdr->p_filesz <= maxsize - phdr->p_offset
+             && memchr (filedata + phdr->p_offset, '\0',
+                        phdr->p_filesz) != NULL)
            printf (gettext ("\t[Requesting program interpreter: %s]\n"),
                    filedata + phdr->p_offset);
        }