https://bugzilla.redhat.com/show_bug.cgi?id=1170810#c16 contains an example of usage of undefined memory when version section data needs to be translated, but the version xlate functions detect they cannot fully transform the section data. To make sure the dest buffer data is completely defined this patch makes sure all data is moved from src to dest first. This is somewhat inefficient since normally all data will be fully converted. But the translation functions have no way to indicate only partial data was converted.
Reported-by: Alexander Cherepanov <[email protected]> Signed-off-by: Mark Wielaard <[email protected]> --- libelf/ChangeLog | 5 +++++ libelf/version_xlate.h | 12 +++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 2ca9509..adfccf1 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,8 @@ +2015-01-03 Mark Wielaard <[email protected]> + + * version_xlate.h (elf_cvt_Verdef): Use memmove to copy src to dest. + (elf_cvt_Verneed): Likewise. + 2014-12-30 Mark Wielaard <[email protected]> * elf_getphdrnum.c (__elf_getphdrnum_chk_rdlock): New function. diff --git a/libelf/version_xlate.h b/libelf/version_xlate.h index 16eaa19..9fe01c6 100644 --- a/libelf/version_xlate.h +++ b/libelf/version_xlate.h @@ -1,5 +1,5 @@ /* Conversion functions for versioning information. - Copyright (C) 1998, 1999, 2000, 2002, 2003 Red Hat, Inc. + Copyright (C) 1998, 1999, 2000, 2002, 2003, 2015 Red Hat, Inc. This file is part of elfutils. Written by Ulrich Drepper <[email protected]>, 1998. @@ -55,6 +55,11 @@ elf_cvt_Verdef (void *dest, const void *src, size_t len, int encode) if (len == 0) return; + /* Below we rely on the next field offsets to be correct, start by + copying over all data as is in case some data isn't translated. + We don't want to leave (undefined) garbage in the dest buffer. */ + memmove (dest, src, len); + do { size_t aux_offset; @@ -149,6 +154,11 @@ elf_cvt_Verneed (void *dest, const void *src, size_t len, int encode) if (len == 0) return; + /* Below we rely on the next field offsets to be correct, start by + copying over all data as is in case some data isn't translated. + We don't want to leave (undefined) garbage in the dest buffer. */ + memmove (dest, src, len); + do { size_t aux_offset; -- 2.1.0
