generic-library/libbsd
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libbsd/libbsd.git synced 2025-01-08 11:02:24 +01:00
Code Issues Projects Releases Wiki Activity

nlist: Check that e_shnum and e_shentsize are within bounds

Browse Source 
The e_shnum must not be 0, otherwise we will do a zero sized allocation
and further processing of the executable will lead to out of bounds
read/write accesses. The e_shentsize must be equal to sizeof(Elf_Shdr),
otherwise we will perform out of bounds read accesses on the shdr array.

Reported-by: Daniel Hodson <daniel@elttam.com.au>
Based-on-patch-by: Daniel Hodson <daniel@elttam.com.au>
Signed-off-by: Guillem Jover <guillem@hadrons.org>
This commit is contained in:
Guillem Jover 2019-06-15 14:33:32 +02:00
parent 3aaedb1208
commit e9529d9b4a
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/nlist.c
View File

@ -141,6 +141,12 @@ __fdnlist(int fd, struct nlist *list)
fstat(fd, &st) < 0)
return (-1);
if (ehdr.e_shnum == 0 ||
ehdr.e_shentsize != sizeof(Elf_Shdr)) {
errno = ERANGE;
return (-1);
}
/* calculate section header table size */
shdr_size = ehdr.e_shentsize * ehdr.e_shnum;