Date: Mon, 29 Dec 2014 20:23:43 +0000 (UTC) From: Ed Maste <emaste@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r276374 - head/contrib/elftoolchain/libelf Message-ID: <201412292023.sBTKNhvg033700@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emaste Date: Mon Dec 29 20:23:42 2014 New Revision: 276374 URL: https://svnweb.freebsd.org/changeset/base/276374 Log: libelf: Do not read past end of buffer Previously a corrupt ELF file could read beyond the end of e_rawfile. Upstream elftoolchain ticket 462. Found via the security/afl fuzzer. Sponsored by: The FreeBSD Foundation Modified: head/contrib/elftoolchain/libelf/elf_scn.c Modified: head/contrib/elftoolchain/libelf/elf_scn.c ============================================================================== --- head/contrib/elftoolchain/libelf/elf_scn.c Mon Dec 29 19:38:12 2014 (r276373) +++ head/contrib/elftoolchain/libelf/elf_scn.c Mon Dec 29 20:23:42 2014 (r276374) @@ -50,6 +50,7 @@ _libelf_load_section_headers(Elf *e, voi Elf64_Ehdr *eh64; int ec, swapbytes; unsigned char *src; + unsigned char *rawend; size_t fsz, i, shnum; int (*xlator)(unsigned char *_d, size_t _dsz, unsigned char *_s, size_t _c, int _swap); @@ -86,6 +87,7 @@ _libelf_load_section_headers(Elf *e, voi swapbytes = e->e_byteorder != LIBELF_PRIVATE(byteorder); src = e->e_rawfile + shoff; + rawend = e->e_rawfile + e->e_rawsize; /* * If the file is using extended numbering then section #0 @@ -102,6 +104,8 @@ _libelf_load_section_headers(Elf *e, voi } for (; i < shnum; i++, src += fsz) { + if (src + sizeof(scn->s_shdr) > rawend) + return (0); if ((scn = _libelf_allocate_scn(e, i)) == NULL) return (0);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201412292023.sBTKNhvg033700>