Author: emaste
Date: Mon Dec 29 20:23:42 2014
New Revision: 276374
URL: https://svnweb.freebsd.org/changeset/base/276374
Log:
libelf: Do not read past end of buffer
Previously a corrupt ELF file could read beyond the end of e_rawfile.
Upstream elftoolchain ticket 462. Found via the security/afl fuzzer.
Sponsored by: The FreeBSD Foundation
Modified:
head/contrib/elftoolchain/libelf/elf_scn.c
Modified: head/contrib/elftoolchain/libelf/elf_scn.c
==============================================================================
--- head/contrib/elftoolchain/libelf/elf_scn.c Mon Dec 29 19:38:12 2014
(r276373)
+++ head/contrib/elftoolchain/libelf/elf_scn.c Mon Dec 29 20:23:42 2014
(r276374)
@@ -50,6 +50,7 @@ _libelf_load_section_headers(Elf *e, voi
Elf64_Ehdr *eh64;
int ec, swapbytes;
unsigned char *src;
+ unsigned char *rawend;
size_t fsz, i, shnum;
int (*xlator)(unsigned char *_d, size_t _dsz, unsigned char *_s,
size_t _c, int _swap);
@@ -86,6 +87,7 @@ _libelf_load_section_headers(Elf *e, voi
swapbytes = e->e_byteorder != LIBELF_PRIVATE(byteorder);
src = e->e_rawfile + shoff;
+ rawend = e->e_rawfile + e->e_rawsize;
/*
* If the file is using extended numbering then section #0
@@ -102,6 +104,8 @@ _libelf_load_section_headers(Elf *e, voi
}
for (; i < shnum; i++, src += fsz) {
+ if (src + sizeof(scn->s_shdr) > rawend)
+ return (0);
if ((scn = _libelf_allocate_scn(e, i)) == NULL)
return (0);
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
