libelf: Handle truncated symbol archive index

When checking the index_size of an / or /SYM64/ symbol archive index
in elf_getarsym we only checked that the index_size contained the
whole offset table, but failed to check there was also room for the
count. Fix this by first making sure to check the index_size is large
enough for the count (4 or 8 bytes), then check that the rest of the
index_size has room for count table offset entries.

https://sourceware.org/bugzilla/show_bug.cgi?id=34401

Reported-by: Karan Kurani <karankurani3k@gmail.com>
Signed-off-by: Mark Wielaard <mark@klomp.org>

diff --git a/libelf/elf_getarsym.c b/libelf/elf_getarsym.c
index 79aa3bbea843f7944bb56a8af8d39536fb7d3956..2ba867ec982691e92016bd24abc4f974b0a56f7c 100644 (file)
--- a/libelf/elf_getarsym.c
+++ b/libelf/elf_getarsym.c
@@ -163,7 +163,7 @@ elf_getarsym (Elf *elf, size_t *ptr)
          __libelf_seterrno (ELF_E_NO_INDEX);
          goto out;
        }
-      int w = index64_p ? 8 : 4;
+      size_t w = index64_p ? 8 : 4;
 
       /* We have an archive.  The first word in there is the number of
         entries in the table.  */
@@ -188,7 +188,8 @@ elf_getarsym (Elf *elf, size_t *ptr)
 #if SIZE_MAX <= 4294967295U
          || n >= SIZE_MAX / sizeof (Elf_Arsym)
 #endif
-         || n > index_size / w)
+         || index_size < w
+         || n > (index_size - w) / w)
        {
          /* This index table cannot be right since it does not fit into
             the file.  */