* grub-core/kern/ia64/dl.c (grub_arch_dl_relocate_symbols): Add checks

	for relocation range.

diff --git a/ChangeLog b/ChangeLog
index ea697a8068696949518036648b02d8cf56cf3a3b..37184be26b14ef9c12779d86e438d34be5f33baa 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2013-12-11  Vladimir Serbinenko  <phcoder@gmail.com>
+
+       * grub-core/kern/ia64/dl.c (grub_arch_dl_relocate_symbols): Add checks
+       for relocation range.
+
 2013-12-11  Vladimir Serbinenko  <phcoder@gmail.com>
 
        * grub-core/kern/ia64/dl.c (grub_arch_dl_relocate_symbols): Handle

diff --git a/grub-core/kern/ia64/dl.c b/grub-core/kern/ia64/dl.c
index d6c183d33333ccb41137daf8c15e386fe7862be2..ad79eb525476d7a186f40b971e7fe28386688df1 100644 (file)
--- a/grub-core/kern/ia64/dl.c
+++ b/grub-core/kern/ia64/dl.c
@@ -26,6 +26,7 @@
 #include <grub/ia64/reloc.h>
 
 #define MASK19 ((1 << 19) - 1)
+#define MASK20 ((1 << 20) - 1)
 
 /* Check if EHDR is a valid ELF header.  */
 grub_err_t
@@ -104,6 +105,10 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr,
          *(grub_uint64_t *) addr += value - addr;
          break;
        case R_IA64_GPREL22:
+         if ((value - (grub_addr_t) mod->base) & ~MASK20)
+           return grub_error (GRUB_ERR_BAD_MODULE,
+                              "gprel offset too big (%lx)",
+                              value - (grub_addr_t) mod->base);
          grub_ia64_add_value_to_slot_21 (addr, value - (grub_addr_t) mod->base);
          break;
 
@@ -115,6 +120,10 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr,
          {
            grub_uint64_t *gpptr = mod->gotptr;
            *gpptr = value;
+           if (((grub_addr_t) gpptr - (grub_addr_t) mod->base) & ~MASK20)
+             return grub_error (GRUB_ERR_BAD_MODULE,
+                                "gprel offset too big (%lx)",
+                                (grub_addr_t) gpptr - (grub_addr_t) mod->base);
            grub_ia64_add_value_to_slot_21 (addr, (grub_addr_t) gpptr - (grub_addr_t) mod->base);
            mod->gotptr = gpptr + 1;
            break;