readelf: check note namesz and descsz
Previously corrupt note namesz or descsz (perhaps caused by readelf's current lack of endian support for notes) resulted in a crash. Check that namesz and descsz do not extend beyond the end of the buffer before trying to access name and desc data. Reported by: jhb MFC after: 3 days Sponsored by: The FreeBSD Foundation
This commit is contained in:
parent
c30e9beba0
commit
721ac29c0c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=358637
@ -3740,6 +3740,10 @@ dump_notes_content(struct readelf *re, const char *buf, size_t sz, off_t off)
|
|||||||
}
|
}
|
||||||
note = (Elf_Note *)(uintptr_t) buf;
|
note = (Elf_Note *)(uintptr_t) buf;
|
||||||
buf += sizeof(Elf_Note);
|
buf += sizeof(Elf_Note);
|
||||||
|
if (buf + roundup2(note->n_namesz, 4) > end) {
|
||||||
|
warnx("invalid note header name");
|
||||||
|
return;
|
||||||
|
}
|
||||||
name = buf;
|
name = buf;
|
||||||
buf += roundup2(note->n_namesz, 4);
|
buf += roundup2(note->n_namesz, 4);
|
||||||
/*
|
/*
|
||||||
@ -3759,6 +3763,10 @@ dump_notes_content(struct readelf *re, const char *buf, size_t sz, off_t off)
|
|||||||
printf(" %-13s %#010jx", name, (uintmax_t) note->n_descsz);
|
printf(" %-13s %#010jx", name, (uintmax_t) note->n_descsz);
|
||||||
printf(" %s\n", note_type(name, re->ehdr.e_type,
|
printf(" %s\n", note_type(name, re->ehdr.e_type,
|
||||||
note->n_type));
|
note->n_type));
|
||||||
|
if (buf + roundup2(note->n_descsz, 4) > end) {
|
||||||
|
warnx("invalid note header desc");
|
||||||
|
return;
|
||||||
|
}
|
||||||
dump_notes_data(re, name, note->n_type, buf, note->n_descsz);
|
dump_notes_data(re, name, note->n_type, buf, note->n_descsz);
|
||||||
buf += roundup2(note->n_descsz, 4);
|
buf += roundup2(note->n_descsz, 4);
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user