From: Mark Wielaard Date: Thu, 11 Dec 2014 15:33:30 +0000 (+0100) Subject: libelf: Correct ELF64 section offset check in file_read_elf. X-Git-Tag: elfutils-0.161~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=65a556fc865657ada6355686dedd282d6f1ad863;p=thirdparty%2Felfutils.git libelf: Correct ELF64 section offset check in file_read_elf. The ELF64 case didn't check for overflow and accidentially used the 32bit Shdr size. Signed-off-by: Mark Wielaard --- diff --git a/libelf/ChangeLog b/libelf/ChangeLog index e4c58499a..cf168e7f9 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,7 @@ +2014-12-11 Mark Wielaard + + * elf_begin.c (file_read_elf): Correct ELF64 section offset check. + 2014-12-11 Mark Wielaard * elf_begin.c (read_long_names): Check for offset overflow. diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index 99a9c0a09..7fb5fa5be 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -412,8 +412,8 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, elf->state.elf64.ehdr = ehdr; if (unlikely (ehdr->e_shoff >= maxsize) - || unlikely (ehdr->e_shoff - + scncnt * sizeof (Elf32_Shdr) > maxsize)) + || unlikely (maxsize - ehdr->e_shoff + < scncnt * sizeof (Elf64_Shdr))) goto free_and_out; elf->state.elf64.shdr = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff);