From f78e8640475ac1ea0b29bff79fbc77c0dfa47657 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Sun, 31 May 2015 15:58:20 +0200 Subject: [PATCH] libelf: Fix unbounded stack usage in elf_getarsym for !ALLOW_UNALIGNED case. The number of entries in the index can be large, don't use alloca to read in temporary data, use malloc (which is freed after out). Signed-off-by: Mark Wielaard --- libelf/ChangeLog | 5 +++++ libelf/elf_getarsym.c | 10 +++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/libelf/ChangeLog b/libelf/ChangeLog index b749c0851..4fd3f9f56 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,8 @@ +2015-05-31 Mark Wielaard + + * elf_getarsym.c (elf_getarsym): Allocate temporary file_date with + malloc, not alloca also in !ALLOW_UNALIGNED case. + 2015-05-30 Mark Wielaard * gelf_xlate.c (elf_cvt_Byte): Only call memmove with non-zero size. diff --git a/libelf/elf_getarsym.c b/libelf/elf_getarsym.c index 4f2080a84..832424410 100644 --- a/libelf/elf_getarsym.c +++ b/libelf/elf_getarsym.c @@ -255,7 +255,15 @@ elf_getarsym (elf, ptr) file_data = (void *) (elf->map_address + off); if (!ALLOW_UNALIGNED && ((uintptr_t) file_data & -(uintptr_t) n) != 0) - file_data = memcpy (alloca (sz), elf->map_address + off, sz); + { + temp_data = malloc (sz); + if (unlikely (temp_data == NULL)) + { + __libelf_seterrno (ELF_E_NOMEM); + goto out; + } + file_data = memcpy (temp_data, elf->map_address + off, sz); + } str_data = (char *) (elf->map_address + off + sz); } -- 2.47.3