From 65a556fc865657ada6355686dedd282d6f1ad863 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Thu, 11 Dec 2014 16:33:30 +0100 Subject: [PATCH] libelf: Correct ELF64 section offset check in file_read_elf. The ELF64 case didn't check for overflow and accidentially used the 32bit Shdr size. Signed-off-by: Mark Wielaard --- libelf/ChangeLog | 4 ++++ libelf/elf_begin.c | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/libelf/ChangeLog b/libelf/ChangeLog index e4c58499a..cf168e7f9 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,7 @@ +2014-12-11 Mark Wielaard + + * elf_begin.c (file_read_elf): Correct ELF64 section offset check. + 2014-12-11 Mark Wielaard * elf_begin.c (read_long_names): Check for offset overflow. diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index 99a9c0a09..7fb5fa5be 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -412,8 +412,8 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, elf->state.elf64.ehdr = ehdr; if (unlikely (ehdr->e_shoff >= maxsize) - || unlikely (ehdr->e_shoff - + scncnt * sizeof (Elf32_Shdr) > maxsize)) + || unlikely (maxsize - ehdr->e_shoff + < scncnt * sizeof (Elf64_Shdr))) goto free_and_out; elf->state.elf64.shdr = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff); -- 2.47.3