From: Mark Wielaard <mark@klomp.org>
Date: Tue, 29 Jan 2019 23:04:11 +0000 (+0100)
Subject: libebl: Check GNU property note data padding fits inside note.
X-Git-Tag: elfutils-0.176~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd7ded3df43f655af945c869976401a602e46fcd;p=thirdparty%2Felfutils.git

libebl: Check GNU property note data padding fits inside note.

The GNU property note data is padded. Make sure the extra padding
still fits in the note description.

https://sourceware.org/bugzilla/show_bug.cgi?id=24075

Signed-off-by: Mark Wielaard <mark@klomp.org>
---

diff --git a/libebl/ChangeLog b/libebl/ChangeLog
index 9cdf8995e..acc68919a 100644
--- a/libebl/ChangeLog
+++ b/libebl/ChangeLog
@@ -1,3 +1,8 @@
+2019-01-29  Mark Wielaard  <mark@klomp.org>
+
+	* eblobjnote.c (ebl_object_note): Check pr_datasz padding doesn't
+	overflow descsz.
+
 2019-01-16  Mark Wielaard  <mark@klomp.org>
 
 	* libebl.h (ebl_core_note): Add desc as argument.
diff --git a/libebl/eblobjnote.c b/libebl/eblobjnote.c
index 9094715c9..f7ac915c5 100644
--- a/libebl/eblobjnote.c
+++ b/libebl/eblobjnote.c
@@ -496,16 +496,17 @@ ebl_object_note (Ebl *ebl, uint32_t namesz, const char *name, uint32_t type,
 			  printf ("%02" PRIx8 "\n", (uint8_t) desc[i]);
 			}
 		    }
+
 		  if (elfclass == ELFCLASS32)
-		    {
-		      desc += NOTE_ALIGN4 (prop.pr_datasz);
-		      descsz -= NOTE_ALIGN4 (prop.pr_datasz);
-		    }
+		    prop.pr_datasz = NOTE_ALIGN4 (prop.pr_datasz);
 		  else
-		    {
-		      desc += NOTE_ALIGN8 (prop.pr_datasz);
-		      descsz -= NOTE_ALIGN8 (prop.pr_datasz);
-		    }
+		    prop.pr_datasz = NOTE_ALIGN8 (prop.pr_datasz);
+
+		  desc += prop.pr_datasz;
+		  if (descsz > prop.pr_datasz)
+		    descsz -= prop.pr_datasz;
+		  else
+		    descsz = 0;
 		}
 	    }
 	  break;