libelf: gelf_getnote check for offset overflow.

Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 45e220d09b230983f762970eb3d3cb1a941265ac..4fbe94c93ed9e4fe6499b41dac13f0a3cf6a705f 100644 (file)
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,7 @@
+2014-11-14  Mark Wielaard  <mjw@redhat.com>
+
+       * gelf_getnote.c (gelf_getnote): Check offset overflow.
+
 2014-11-13  Mark Wielaard  <mjw@redhat.com>
 
        * elf_getdata.c (__libelf_set_rawdata_wrlock): Fix unsigned overflow

diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c
index 1a36855331b8f9a764444e8b06ced6bfb0bf6567..8bb78c166f0abf0ec4903fe596d7a4435429f812 100644 (file)
--- a/libelf/gelf_getnote.c
+++ b/libelf/gelf_getnote.c
@@ -1,5 +1,5 @@
 /* Get note information at the supplied offset.
-   Copyright (C) 2007 Red Hat, Inc.
+   Copyright (C) 2007, 2014 Red Hat, Inc.
    This file is part of elfutils.
 
    This file is free software; you can redistribute it and/or modify
@@ -62,7 +62,8 @@ gelf_getnote (data, offset, result, name_offset, desc_offset)
 
   /* The data is already in the correct form.  Just make sure the
      offset is OK.  */
-  if (unlikely (offset + sizeof (GElf_Nhdr) > data->d_size))
+  if (unlikely (offset > data->d_size
+               || data->d_size - offset < sizeof (GElf_Nhdr)))
     {
       __libelf_seterrno (ELF_E_OFFSET_RANGE);
       offset = 0;