From 9a0d9d314a6342b56e3277bd7ad7ecb6e73a7d38 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Mon, 27 Mar 2017 23:59:02 +0200 Subject: [PATCH] elflint: Check symbol table data is big enough before checking. Before checking symbol index zero we should make sure the data size is big enough. https://sourceware.org/bugzilla/show_bug.cgi?id=21310 Signed-off-by: Mark Wielaard --- src/ChangeLog | 4 ++++ src/elflint.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/ChangeLog b/src/ChangeLog index 41381aa03..6031213f0 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,7 @@ +2017-03-27 Mark Wielaard + + * elflint.c (check_symtab_shndx): Check data->d_size. + 2017-03-24 Mark Wielaard * elfcmp.c (main): If n_namesz == 0 then the note name data is the diff --git a/src/elflint.c b/src/elflint.c index 66a13ca22..76fb1a0c5 100644 --- a/src/elflint.c +++ b/src/elflint.c @@ -1959,7 +1959,8 @@ section [%2d] '%s': extended section index in section [%2zu] '%s' refers to same return; } - if (*((Elf32_Word *) data->d_buf) != 0) + if (data->d_size < sizeof (Elf32_Word) + || *((Elf32_Word *) data->d_buf) != 0) ERROR (gettext ("symbol 0 should have zero extended section index\n")); for (size_t cnt = 1; cnt < data->d_size / sizeof (Elf32_Word); ++cnt) -- 2.47.3