d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

crunchide: add basic string table sanity checks

Browse Source 
Reported by:	Coverity Scan
CID:		978805, 980919
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Ed Maste 2015-04-28 13:04:51 +00:00
parent 6508929bc2
commit e52f97153a
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
usr.sbin/crunch/crunchide/exec_elf32.c
View File

@ -321,11 +321,14 @@ ELFNAMEEND(hide)(int fd, const char *fn)
*/ */
/* load section string table for debug use */ /* load section string table for debug use */
if ((shstrtabp = xmalloc(xewtoh(shstrtabshdr->sh_size), fn, if ((size = xewtoh(shstrtabshdr->sh_size)) == 0)
"section string table")) == NULL) goto bad;
if ((shstrtabp = xmalloc(size, fn, "section string table")) == NULL)
goto bad; goto bad;
if ((size_t)xreadatoff(fd, shstrtabp, xewtoh(shstrtabshdr->sh_offset), if ((size_t)xreadatoff(fd, shstrtabp, xewtoh(shstrtabshdr->sh_offset),
xewtoh(shstrtabshdr->sh_size), fn) != xewtoh(shstrtabshdr->sh_size)) size, fn) != size)
goto bad;
if (shstrtabp[size - 1] != '\0')
goto bad; goto bad;
/* we need symtab, strtab, and everything behind strtab */ /* we need symtab, strtab, and everything behind strtab */
@ -346,7 +349,8 @@ ELFNAMEEND(hide)(int fd, const char *fn)
strtabidx = i; strtabidx = i;
if (layoutp[i].shdr == symtabshdr || i >= strtabidx) { if (layoutp[i].shdr == symtabshdr || i >= strtabidx) {
off = xewtoh(layoutp[i].shdr->sh_offset); off = xewtoh(layoutp[i].shdr->sh_offset);
size = xewtoh(layoutp[i].shdr->sh_size); if ((size = xewtoh(layoutp[i].shdr->sh_size)) == 0)
goto bad;
layoutp[i].bufp = xmalloc(size, fn, layoutp[i].bufp = xmalloc(size, fn,
shstrtabp + xewtoh(layoutp[i].shdr->sh_name)); shstrtabp + xewtoh(layoutp[i].shdr->sh_name));
if (layoutp[i].bufp == NULL) if (layoutp[i].bufp == NULL)
@ -356,10 +360,13 @@ ELFNAMEEND(hide)(int fd, const char *fn)
goto bad; goto bad;
/* set symbol table and string table */ /* set symbol table and string table */
if (layoutp[i].shdr == symtabshdr) if (layoutp[i].shdr == symtabshdr) {
symtabp = layoutp[i].bufp; symtabp = layoutp[i].bufp;
else if (layoutp[i].shdr == strtabshdr) } else if (layoutp[i].shdr == strtabshdr) {
strtabp = layoutp[i].bufp; strtabp = layoutp[i].bufp;
if (strtabp[size - 1] != '\0')
goto bad;
}
} }
} }