libelf: Make sure ar archive long_names len fits in mapped ELF file.

Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index fe210abb5244cc52f6f91fda8e3f5fd64b132a89..270579b05ccded146e38315bc5f95aea20e95300 100644 (file)
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,8 @@
+2014-12-16  Mark Wielaard  <mjw@redhat.com>
+
+       * elf_begin.c (read_long_names): Make sure long_names len fits
+       in mapped ELF file.
+
 2014-12-15  Mark Wielaard  <mjw@redhat.com>
 
        * elf_getarsym.c (elf_getarsym): Check index_size doesn't overflow.

diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c
index c24a36426db0ba6e6288132113d69f0cd4be9eb2..30abe0bface4fe901f60982798897fe467fb5c6d 100644 (file)
--- a/libelf/elf_begin.c
+++ b/libelf/elf_begin.c
@@ -708,11 +708,15 @@ read_long_names (Elf *elf)
       char *runp;
 
       if (elf->map_address != NULL)
-       /* Simply copy it over.  */
-       elf->state.ar.long_names = (char *) memcpy (newp,
-                                                   elf->map_address + offset
-                                                   + sizeof (struct ar_hdr),
-                                                   len);
+       {
+         if (len > elf->maximum_size - offset - sizeof (struct ar_hdr))
+           goto too_much;
+         /* Simply copy it over.  */
+         elf->state.ar.long_names = (char *) memcpy (newp,
+                                                     elf->map_address + offset
+                                                     + sizeof (struct ar_hdr),
+                                                     len);
+       }
       else
        {
          if (unlikely ((size_t) pread_retry (elf->fildes, newp, len,
@@ -720,6 +724,7 @@ read_long_names (Elf *elf)
                                              + sizeof (struct ar_hdr))
                        != len))
            {
+           too_much:
              /* We were not able to read all data.  */
              free (newp);
              elf->state.ar.long_names = NULL;