From: Mark Wielaard Date: Wed, 16 Jan 2019 11:25:57 +0000 (+0100) Subject: libelf: Correct overflow check in note_xlate. X-Git-Tag: elfutils-0.176~16 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e65d91d21cb09d83b001fef9435e576ba447db32;p=thirdparty%2Felfutils.git libelf: Correct overflow check in note_xlate. We want to make sure the note_len doesn't overflow and becomes shorter than the note header. But the namesz and descsz checks got the note header size wrong). Replace the wrong constant (8) with a sizeof cvt_Nhdr (12). https://sourceware.org/bugzilla/show_bug.cgi?id=24084 Signed-off-by: Mark Wielaard --- diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 5923c85c0..5783f0c3b 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,8 @@ +2019-01-16 Mark Wielaard + + * note_xlate.h (elf_cvt_note): Check n_namesz and n_descsz don't + overflow note_len into note header. + 2018-11-17 Mark Wielaard * elf32_updatefile.c (updatemmap): Make sure to call convert diff --git a/libelf/note_xlate.h b/libelf/note_xlate.h index 9bdc3e2ca..bc9950ffb 100644 --- a/libelf/note_xlate.h +++ b/libelf/note_xlate.h @@ -46,13 +46,13 @@ elf_cvt_note (void *dest, const void *src, size_t len, int encode, /* desc needs to be aligned. */ note_len += n->n_namesz; note_len = nhdr8 ? NOTE_ALIGN8 (note_len) : NOTE_ALIGN4 (note_len); - if (note_len > len || note_len < 8) + if (note_len > len || note_len < sizeof *n) break; /* data as a whole needs to be aligned. */ note_len += n->n_descsz; note_len = nhdr8 ? NOTE_ALIGN8 (note_len) : NOTE_ALIGN4 (note_len); - if (note_len > len || note_len < 8) + if (note_len > len || note_len < sizeof *n) break; /* Copy or skip the note data. */