libelf: Copy over any leftover data from src to dest in elf_cvt_note.

If any data is left then the data is likely part of the truncated note
name/desc. This probably means the note is corrupted, but it is better
to have the actual data in dest instead of random uninitialized memory.

Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index b21714e3b436a3079c1199f2a3f52d33fdb56a5d..8a115631ebc229b04783e775a9650edc2f640786 100644 (file)
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,8 @@
+2014-11-23  Mark Wielaard  <mjw@redhat.com>
+
+       * note_xlate.h (elf_cvt_note): Copy over any leftover data if
+       src != dest. The data is probably part of truncated name/desc.
+
 2014-11-22  Mark Wielaard  <mjw@redhat.com>
 
        * elf_getphdrnum.c (elf_getphdrnum): Sanity check the

diff --git a/libelf/note_xlate.h b/libelf/note_xlate.h
index 8187e88104038be5d5947c1fd80b6b57a10d8e3f..62c6f63de18c478c5980135119cd8e50f6b344f0 100644 (file)
--- a/libelf/note_xlate.h
+++ b/libelf/note_xlate.h
@@ -1,5 +1,5 @@
 /* Conversion functions for notes.
-   Copyright (C) 2007, 2009 Red Hat, Inc.
+   Copyright (C) 2007, 2009, 2014 Red Hat, Inc.
    This file is part of elfutils.
 
    This file is free software; you can redistribute it and/or modify
@@ -56,4 +56,9 @@ elf_cvt_note (void *dest, const void *src, size_t len, int encode)
       src += namesz + descsz;
       dest += namesz + descsz;
     }
+
+    /* Copy opver any leftover data unconcerted.  Probably part of
+       truncated name/desc data.  */
+    if (unlikely (len > 0) && src != dest)
+      memcpy (dest, src, len);
 }