From: Mark Wielaard <mjw@redhat.com>
Date: Sun, 16 Nov 2014 10:30:51 +0000 (+0100)
Subject: gelf_getnote: Check padding overflow.
X-Git-Tag: elfutils-0.161~85
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8ea90b7a5c030321d70bea246c989fc18c404a14;p=thirdparty%2Felfutils.git

gelf_getnote: Check padding overflow.

Since ELF notes need to be properly aligned they can include padding.
Make sure the padding itself and the padding calculation doesn't overflow.

Signed-off-by: Mark Wielaard <mjw@redhat.com>
---

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 488609392..beb431fda 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,7 @@
+2014-11-16  Mark Wielaard  <mjw@redhat.com>
+
+	* gelf_getnote.c (gelf_getnote): Check padding overflow.
+
 2014-11-16  Mark Wielaard  <mjw@redhat.com>
 
 	* elf_getdata.c (__libelf_set_rawdata_wrlock): Declare offset, size
diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c
index 8bb78c166..7dc821567 100644
--- a/libelf/gelf_getnote.c
+++ b/libelf/gelf_getnote.c
@@ -73,16 +73,21 @@ gelf_getnote (data, offset, result, name_offset, desc_offset)
       const GElf_Nhdr *n = data->d_buf + offset;
       offset += sizeof *n;
 
+      /* Include padding.  Check below for overflow.  */
       GElf_Word namesz = NOTE_ALIGN (n->n_namesz);
       GElf_Word descsz = NOTE_ALIGN (n->n_descsz);
 
-      if (unlikely (data->d_size - offset < namesz))
+      if (unlikely (offset > data->d_size
+		    || data->d_size - offset < namesz
+		    || (namesz == 0 && n->n_namesz != 0)))
 	offset = 0;
       else
 	{
 	  *name_offset = offset;
 	  offset += namesz;
-	  if (unlikely (data->d_size - offset < descsz))
+	  if (unlikely (offset > data->d_size
+			|| data->d_size - offset < descsz
+			|| (descsz == 0 && n->n_descsz != 0)))
 	    offset = 0;
 	  else
 	    {