[Qemu-devel] [PATCH 08/14] linux-user: Improve consistency checking in elf headers.

[Richard Henderson]

Validate more fields of the elf header.  Extract those checks
into two common functions to be used in both load_elf_interp
and load_elf_binary.

Signed-off-by: Richard Henderson <r...@twiddle.net>
---
 linux-user/elfload.c |   57 +++++++++++++++++++++++++++++---------------------
 1 files changed, 33 insertions(+), 24 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 7e94fe3..5853a30 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -919,6 +919,30 @@ static int elf_core_dump(int, const CPUState *);
 #endif /* USE_ELF_CORE_DUMP */
 static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias);
 
+/* Verify the portions of EHDR within E_IDENT for the target.
+   This can be performed before bswapping the entire header.  */
+static _Bool elf_check_ident(struct elfhdr *ehdr)
+{
+    return (ehdr->e_ident[EI_MAG0] == ELFMAG0
+            && ehdr->e_ident[EI_MAG1] == ELFMAG1
+            && ehdr->e_ident[EI_MAG2] == ELFMAG2
+            && ehdr->e_ident[EI_MAG3] == ELFMAG3
+            && ehdr->e_ident[EI_CLASS] == ELF_CLASS
+            && ehdr->e_ident[EI_DATA] == ELF_DATA
+            && ehdr->e_ident[EI_VERSION] == EV_CURRENT);
+}
+
+/* Verify the portions of EHDR outside of E_IDENT for the target.
+   This has to wait until after bswapping the header.  */
+static _Bool elf_check_ehdr(struct elfhdr *ehdr)
+{
+    return (elf_check_arch(ehdr->e_machine)
+            && ehdr->e_ehsize == sizeof(struct elfhdr)
+            && ehdr->e_phentsize == sizeof(struct elf_phdr)
+            && ehdr->e_shentsize == sizeof(struct elf_shdr)
+            && (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN));
+}
+
 /*
  * 'copy_elf_strings()' copies argument/envelope strings from user
  * memory to free pages in kernel mem. These are in a format ready
@@ -1149,33 +1173,16 @@ static abi_ulong load_elf_interp(struct elfhdr * 
interp_elf_ex,
     int i;
 
     bswap_ehdr(interp_elf_ex);
-    /* First of all, some simple consistency checks */
-    if ((interp_elf_ex->e_type != ET_EXEC &&
-         interp_elf_ex->e_type != ET_DYN) ||
-        !elf_check_arch(interp_elf_ex->e_machine)) {
+    if (!elf_check_ehdr(interp_elf_ex)) {
         return ~((abi_ulong)0UL);
     }
 
     /* Now read in all of the header information */
-
-    if (sizeof(struct elf_phdr) * interp_elf_ex->e_phnum > TARGET_PAGE_SIZE)
-        return ~(abi_ulong)0UL;
-
     elf_phdata =  (struct elf_phdr *)
         malloc(sizeof(struct elf_phdr) * interp_elf_ex->e_phnum);
-
     if (!elf_phdata)
         return ~((abi_ulong)0UL);
 
-    /*
-     * If the size of this structure has changed, then punt, since
-     * we will be doing the wrong thing.
-     */
-    if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr)) {
-        free(elf_phdata);
-        return ~((abi_ulong)0UL);
-    }
-
     i = interp_elf_ex->e_phnum * sizeof(struct elf_phdr);
     if (interp_elf_ex->e_phoff + i <= BPRM_BUF_SIZE) {
         memcpy(elf_phdata, bprm_buf + interp_elf_ex->e_phoff, i);
@@ -1427,11 +1434,13 @@ int load_elf_binary(struct linux_binprm * bprm, struct 
target_pt_regs * regs,
     load_addr = 0;
     load_bias = 0;
     elf_ex = *((struct elfhdr *) bprm->buf);          /* exec-header */
-    bswap_ehdr(&elf_ex);
 
     /* First of all, some simple consistency checks */
-    if ((elf_ex.e_type != ET_EXEC && elf_ex.e_type != ET_DYN) ||
-        (! elf_check_arch(elf_ex.e_machine))) {
+    if (!elf_check_ident(&elf_ex)) {
+        return -ENOEXEC;
+    }
+    bswap_ehdr(&elf_ex);
+    if (!elf_check_ehdr(&elf_ex)) {
         return -ENOEXEC;
     }
 
@@ -1443,7 +1452,8 @@ int load_elf_binary(struct linux_binprm * bprm, struct 
target_pt_regs * regs,
     }
 
     /* Now read in all of the header information */
-    elf_phdata = (struct elf_phdr *)malloc(elf_ex.e_phentsize*elf_ex.e_phnum);
+    elf_phdata = (struct elf_phdr *)
+        malloc(elf_ex.e_phnum * sizeof(struct elf_phdr));
     if (elf_phdata == NULL) {
        return -ENOMEM;
     }
@@ -1548,8 +1558,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct 
target_pt_regs * regs,
             interpreter_type = INTERPRETER_ELF;
        }
 
-       if (interp_elf_ex.e_ident[0] != 0x7f ||
-            strncmp((char *)&interp_elf_ex.e_ident[1], "ELF",3) != 0) {
+        if (!elf_check_ident(&interp_elf_ex)) {
            interpreter_type &= ~INTERPRETER_ELF;
        }
 
-- 
1.6.6.1