When we use elf_mem*_unsafe, we need to check that we are not doing too much work.
Ensure that a call to elf_iter_ok_counted is near every call to elf_mem*_unsafe. (At one call site, just have a comment instead.) Signed-off-by: Ian Jackson <ian.jack...@eu.citrix.com> --- xen/common/libelf/libelf-dominfo.c | 1 + xen/common/libelf/libelf-loader.c | 2 +- xen/common/libelf/libelf-tools.c | 6 ++++-- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/xen/common/libelf/libelf-dominfo.c b/xen/common/libelf/libelf-dominfo.c index b139e32..87a47d9 100644 --- a/xen/common/libelf/libelf-dominfo.c +++ b/xen/common/libelf/libelf-dominfo.c @@ -498,6 +498,7 @@ elf_errorstatus elf_xen_parse(struct elf_binary *elf, unsigned total_note_count = 0; elf_memset_unchecked(parms, 0, sizeof(*parms)); + elf_iter_ok_counted(elf, sizeof(*parms)); parms->virt_base = UNSET_ADDR; parms->virt_entry = UNSET_ADDR; parms->virt_hypercall = UNSET_ADDR; diff --git a/xen/common/libelf/libelf-loader.c b/xen/common/libelf/libelf-loader.c index 68c9021..d5e51d3 100644 --- a/xen/common/libelf/libelf-loader.c +++ b/xen/common/libelf/libelf-loader.c @@ -46,7 +46,7 @@ elf_errorstatus elf_init(struct elf_binary *elf, const char *image_input, size_t return -1; } - elf_memset_unchecked(elf, 0, sizeof(*elf)); + elf_memset_unchecked(elf, 0, sizeof(*elf)); /* loop safety: singleton */ elf->image_base = image_input; elf->size = size; elf->ehdr = ELF_MAKE_HANDLE(elf_ehdr, (elf_ptrval)image_input); diff --git a/xen/common/libelf/libelf-tools.c b/xen/common/libelf/libelf-tools.c index 56dab63..ab83150 100644 --- a/xen/common/libelf/libelf-tools.c +++ b/xen/common/libelf/libelf-tools.c @@ -69,7 +69,8 @@ void elf_memcpy_safe(struct elf_binary *elf, elf_ptrval dst, elf_ptrval src, size_t size) { if ( elf_access_ok(elf, dst, size) && - elf_access_ok(elf, src, size) ) + elf_access_ok(elf, src, size) && + elf_iter_ok_counted(elf, size) ) { /* use memmove because these checks do not prove that the * regions don't overlap and overlapping regions grant @@ -80,7 +81,8 @@ void elf_memcpy_safe(struct elf_binary *elf, elf_ptrval dst, void elf_memset_safe(struct elf_binary *elf, elf_ptrval dst, int c, size_t size) { - if ( elf_access_ok(elf, dst, size) ) + if ( elf_access_ok(elf, dst, size) && + elf_iter_ok_counted(elf, size)) { elf_memset_unchecked(ELF_UNSAFE_PTR(dst), c, size); } -- 2.1.4 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org https://lists.xen.org/xen-devel