elf_from_remote_memory allocates a buffer of contents_size and then
writes the ELF header into it. When the last PT_LOAD has p_filesz 0
(and p_memsz nonzero) contents_size collapses to zero and the 52/64
byte header is written past the allocation. Reject the image before
allocating when contents_size is smaller than the header. This
completes commit 2ee961ba, which bounded the segment copies; the header
write is the remaining out-of-bounds path.
* libdwfl/elf-from-memory.c (elf_from_remote_memory): Goto bad_elf
when contents_size is smaller than the Ehdr.
Signed-off-by: Matej Smycka <[email protected]>
---
libdwfl/elf-from-memory.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libdwfl/elf-from-memory.c b/libdwfl/elf-from-memory.c
index 775d5a1f..4015efd2 100644
--- a/libdwfl/elf-from-memory.c
+++ b/libdwfl/elf-from-memory.c
@@ -282,6 +282,11 @@ elf_from_remote_memory (GElf_Addr ehdr_vma,
else
contents_size = segments_end;
+ /* Make sure the image is big enough for the ELF header written out
+ below; otherwise the elfNN_xlatetof of the header overflows it. */
+ if (contents_size < (class32 ? sizeof ehdr.e32 : sizeof ehdr.e64))
+ goto bad_elf;
+
free (buffer);
/* Now we know the size of the whole image we want read in. */
--
2.47.3
