56 lines
1.6 KiB
Diff
56 lines
1.6 KiB
Diff
From 480b6fa3662ba8ffeee274bf0d37423413c01e55 Mon Sep 17 00:00:00 2001
|
|
From: Mark Wielaard <mark@klomp.org>
|
|
Date: Wed, 3 Mar 2021 21:40:53 +0100
|
|
Subject: [PATCH] readelf: Sanity check verneed and verdef offsets in
|
|
handle_symtab.
|
|
|
|
We are going through vna_next, vn_next and vd_next in a while loop.
|
|
Make sure that all offsets are sane. We don't want things to wrap
|
|
around so we go in cycles.
|
|
|
|
https://sourceware.org/bugzilla/show_bug.cgi?id=27501
|
|
|
|
Signed-off-by: Mark Wielaard <mark@klomp.org>
|
|
---
|
|
src/readelf.c | 10 +++++++++-
|
|
1 files changed, 9 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/readelf.c b/src/readelf.c
|
|
index 715af3b3..b9740455 100644
|
|
--- a/src/readelf.c
|
|
+++ b/src/readelf.c
|
|
@@ -2554,7 +2554,9 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
|
|
&vernaux_mem);
|
|
while (vernaux != NULL
|
|
&& vernaux->vna_other != *versym
|
|
- && vernaux->vna_next != 0)
|
|
+ && vernaux->vna_next != 0
|
|
+ && (verneed_data->d_size - vna_offset
|
|
+ >= vernaux->vna_next))
|
|
{
|
|
/* Update the offset. */
|
|
vna_offset += vernaux->vna_next;
|
|
@@ -2571,6 +2573,9 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
|
|
/* Found it. */
|
|
break;
|
|
|
|
+ if (verneed_data->d_size - vn_offset < verneed->vn_next)
|
|
+ break;
|
|
+
|
|
vn_offset += verneed->vn_next;
|
|
verneed = (verneed->vn_next == 0
|
|
? NULL
|
|
@@ -2606,6 +2611,9 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
|
|
/* Found the definition. */
|
|
break;
|
|
|
|
+ if (verdef_data->d_size - vd_offset < verdef->vd_next)
|
|
+ break;
|
|
+
|
|
vd_offset += verdef->vd_next;
|
|
verdef = (verdef->vd_next == 0
|
|
? NULL
|
|
--
|
|
2.27.0
|
|
|