diff options
author | Ulf Hermann <ulf.hermann@qt.io> | 2017-03-27 18:47:45 +0200 |
---|---|---|
committer | Ulf Hermann <ulf.hermann@qt.io> | 2017-04-26 09:09:41 +0000 |
commit | 7418ca577be88ad40d6aad3c46efda702d5c5294 (patch) | |
tree | 0bc521c335294504a338dd2a2bf728821c01d605 /libdwfl | |
parent | eddc6f8abfa6535f73ea1176eb3c6ce6dc91baa9 (diff) |
Protect against integer overflow on shnum
If shnum is 0, the many "shnum - 1" would result in an overflow. Check it
for 0, and only subtract once, rather than on every usage.
Change-Id: I37a9e5d4e012a501d5ec98762ec0a435c743e25f
Reviewed-by: Christian Kandeler <christian.kandeler@qt.io>
Diffstat (limited to 'libdwfl')
-rw-r--r-- | libdwfl/ChangeLog | 5 | ||||
-rw-r--r-- | libdwfl/dwfl_module_getdwarf.c | 18 |
2 files changed, 15 insertions, 8 deletions
diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog index 0692fd6b..74c6e3fb 100644 --- a/libdwfl/ChangeLog +++ b/libdwfl/ChangeLog @@ -1,5 +1,10 @@ 2017-04-20 Ulf Hermann <ulf.hermann@qt.io> + * dwfl_module_getdwarf.c: Check shnum for 0 before subtracting from + it. + +2017-04-20 Ulf Hermann <ulf.hermann@qt.io> + * libdwfl.h: Use __const_attribute__. 2017-04-20 Ulf Hermann <ulf.hermann@qt.io> diff --git a/libdwfl/dwfl_module_getdwarf.c b/libdwfl/dwfl_module_getdwarf.c index 46caece5..c8b839dc 100644 --- a/libdwfl/dwfl_module_getdwarf.c +++ b/libdwfl/dwfl_module_getdwarf.c @@ -349,12 +349,14 @@ find_prelink_address_sync (Dwfl_Module *mod, struct dwfl_file *file) /* Since prelink does not store the zeroth section header in the undo section, it cannot support SHN_XINDEX encoding. */ - if (unlikely (shnum >= SHN_LORESERVE) + if (unlikely (shnum >= SHN_LORESERVE) || unlikely(shnum == 0) || unlikely (undodata->d_size != (src.d_size + phnum * phentsize + (shnum - 1) * shentsize))) return DWFL_E_BAD_PRELINK; + --shnum; + /* We look at the allocated SHT_PROGBITS (or SHT_NOBITS) sections. (Most every file will have some SHT_PROGBITS sections, but it's possible to have one with nothing but .bss, i.e. SHT_NOBITS.) The special sections @@ -431,12 +433,12 @@ find_prelink_address_sync (Dwfl_Module *mod, struct dwfl_file *file) src.d_buf += src.d_size; src.d_type = ELF_T_SHDR; - src.d_size = gelf_fsize (mod->main.elf, ELF_T_SHDR, shnum - 1, EV_CURRENT); + src.d_size = gelf_fsize (mod->main.elf, ELF_T_SHDR, shnum, EV_CURRENT); size_t shdr_size = class32 ? sizeof (Elf32_Shdr) : sizeof (Elf64_Shdr); - if (unlikely (shnum - 1 > SIZE_MAX / shdr_size)) + if (unlikely (shnum > SIZE_MAX / shdr_size)) return DWFL_E_NOMEM; - const size_t shdrs_bytes = (shnum - 1) * shdr_size; + const size_t shdrs_bytes = shnum * shdr_size; void *shdrs = malloc (shdrs_bytes); if (unlikely (shdrs == NULL)) return DWFL_E_NOMEM; @@ -488,16 +490,16 @@ find_prelink_address_sync (Dwfl_Module *mod, struct dwfl_file *file) highest = 0; if (class32) { - Elf32_Shdr (*s32)[shnum - 1] = shdrs; - for (size_t i = 0; i < shnum - 1; ++i) + Elf32_Shdr (*s32)[shnum] = shdrs; + for (size_t i = 0; i < shnum; ++i) consider_shdr (undo_interp, (*s32)[i].sh_type, (*s32)[i].sh_flags, (*s32)[i].sh_addr, (*s32)[i].sh_size, &highest); } else { - Elf64_Shdr (*s64)[shnum - 1] = shdrs; - for (size_t i = 0; i < shnum - 1; ++i) + Elf64_Shdr (*s64)[shnum] = shdrs; + for (size_t i = 0; i < shnum; ++i) consider_shdr (undo_interp, (*s64)[i].sh_type, (*s64)[i].sh_flags, (*s64)[i].sh_addr, (*s64)[i].sh_size, &highest); |