From f62658f71fdcf6a51e0dac1bfe4ab082be03bb8a Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Sun, 23 Nov 2014 21:54:51 +0100 Subject: [PATCH] libelf: Change signed overflow check to unsigned in elf_getdata_rawchunk. Arithmetic of signed values that overflow causes undefined behaviour Change to explicit unsigned arithmetic overflow check. Signed-off-by: Mark Wielaard --- libelf/ChangeLog | 5 +++++ libelf/elf_getdata_rawchunk.c | 7 ++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 8a115631e..68fb0fc1f 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,8 @@ +2014-11-23 Mark Wielaard + + * elf_getdata_rawchunk.c (elf_getdata_rawchunk): Change signed + overflow check to unsigned. + 2014-11-23 Mark Wielaard * note_xlate.h (elf_cvt_note): Copy over any leftover data if diff --git a/libelf/elf_getdata_rawchunk.c b/libelf/elf_getdata_rawchunk.c index f4fbe660b..63a9914fd 100644 --- a/libelf/elf_getdata_rawchunk.c +++ b/libelf/elf_getdata_rawchunk.c @@ -1,5 +1,5 @@ /* Return converted data from raw chunk of ELF file. - Copyright (C) 2007 Red Hat, Inc. + Copyright (C) 2007, 2014 Red Hat, Inc. This file is part of elfutils. This file is free software; you can redistribute it and/or modify @@ -57,8 +57,9 @@ elf_getdata_rawchunk (elf, offset, size, type) return NULL; } - if (unlikely (offset < 0 || offset + (off64_t) size < offset - || offset + size > elf->maximum_size)) + if (unlikely (offset < 0 || (uint64_t) offset > elf->maximum_size + || elf->maximum_size - (uint64_t) offset < size)) + { /* Invalid request. */ __libelf_seterrno (ELF_E_INVALID_OP); -- 2.47.2