When checking the index_size of an / or /SYM64/ symbol archive index in elf_getarsym we only checked that the index_size contained the whole offset table, but failed to check there was also room for the count. Fix this by first making sure to check the index_size is large enough for the count (4 or 8 bytes), then check that the rest of the index_size has room for count table offset entries.
https://sourceware.org/bugzilla/show_bug.cgi?id=34401 Reported-by: Karan Kurani <[email protected]> Signed-off-by: Mark Wielaard <[email protected]> --- libelf/elf_getarsym.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libelf/elf_getarsym.c b/libelf/elf_getarsym.c index 79aa3bbea843..2ba867ec9826 100644 --- a/libelf/elf_getarsym.c +++ b/libelf/elf_getarsym.c @@ -163,7 +163,7 @@ elf_getarsym (Elf *elf, size_t *ptr) __libelf_seterrno (ELF_E_NO_INDEX); goto out; } - int w = index64_p ? 8 : 4; + size_t w = index64_p ? 8 : 4; /* We have an archive. The first word in there is the number of entries in the table. */ @@ -188,7 +188,8 @@ elf_getarsym (Elf *elf, size_t *ptr) #if SIZE_MAX <= 4294967295U || n >= SIZE_MAX / sizeof (Elf_Arsym) #endif - || n > index_size / w) + || index_size < w + || n > (index_size - w) / w) { /* This index table cannot be right since it does not fit into the file. */ -- 2.54.0
