d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

size: Avoid returning a stack pointer from xlatetom().

Browse Source 
The callers only check whether the returned pointer is non-NULL, so this
was harmless in practice, but change the return value to guard against
the issue.

CID:		1411597
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Mark Johnston 2020-02-04 21:17:59 +00:00
parent 640ff6ed84
commit b7fc41b3ca
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
contrib/elftoolchain/size/size.c
View File

@ -240,7 +240,7 @@ main(int argc, char **argv)
return (rc);
}
static Elf_Data *
static int
xlatetom(Elf *elf, GElf_Ehdr *elfhdr, void *_src, void *_dst,
Elf_Type type, size_t size)
{
@ -253,7 +253,8 @@ xlatetom(Elf *elf, GElf_Ehdr *elfhdr, void *_src, void *_dst,
dst.d_buf = _dst;
dst.d_version = elfhdr->e_version;
dst.d_size = size;
return (gelf_xlatetom(elf, &dst, &src, elfhdr->e_ident[EI_DATA]));
return (gelf_xlatetom(elf, &dst, &src, elfhdr->e_ident[EI_DATA]) !=
NULL ? 0 : 1);
}
#define NOTE_OFFSET_32(nhdr, namesz, offset) \
@ -314,12 +315,12 @@ handle_core_note(Elf *elf, GElf_Ehdr *elfhdr, GElf_Phdr *phdr,
while (data != NULL && offset + sizeof(Elf32_Nhdr) < segment_end) {
nhdr = (Elf32_Nhdr *)(uintptr_t)((char*)data + offset);
memset(&nhdr_l, 0, sizeof(Elf32_Nhdr));
if (!xlatetom(elf, elfhdr, &nhdr->n_type, &nhdr_l.n_type,
ELF_T_WORD, sizeof(Elf32_Word)) ||
!xlatetom(elf, elfhdr, &nhdr->n_descsz, &nhdr_l.n_descsz,
ELF_T_WORD, sizeof(Elf32_Word)) ||
!xlatetom(elf, elfhdr, &nhdr->n_namesz, &nhdr_l.n_namesz,
ELF_T_WORD, sizeof(Elf32_Word)))
if (xlatetom(elf, elfhdr, &nhdr->n_type, &nhdr_l.n_type,
ELF_T_WORD, sizeof(Elf32_Word)) != 0 ||
xlatetom(elf, elfhdr, &nhdr->n_descsz, &nhdr_l.n_descsz,
ELF_T_WORD, sizeof(Elf32_Word)) != 0 ||
xlatetom(elf, elfhdr, &nhdr->n_namesz, &nhdr_l.n_namesz,
ELF_T_WORD, sizeof(Elf32_Word)) != 0)
break;
if (offset + sizeof(Elf32_Nhdr) +
@ -356,10 +357,10 @@ handle_core_note(Elf *elf, GElf_Ehdr *elfhdr, GElf_Phdr *phdr,
pid = PID64(nhdr,
nhdr_l.n_namesz, 40);
}
xlatetom(elf, elfhdr, &raw_size, &raw_size,
ELF_T_WORD, sizeof(uint64_t));
xlatetom(elf, elfhdr, &pid, &pid, ELF_T_WORD,
sizeof(pid_t));
(void)xlatetom(elf, elfhdr, &raw_size,
&raw_size, ELF_T_WORD, sizeof(uint64_t));
(void)xlatetom(elf, elfhdr, &pid, &pid,
ELF_T_WORD, sizeof(pid_t));
}
if (raw_size != 0 && style == STYLE_SYSV) {