Print this page
5507 libelf may overflow data buffer when translating data to memory representation

Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/sgs/libelf/common/clscook.c
          +++ new/usr/src/cmd/sgs/libelf/common/clscook.c
↓ open down ↓ 19 lines elided ↑ open up ↑
  20   20   */
  21   21  
  22   22  /*
  23   23   * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  24   24   * Use is subject to license terms.
  25   25   */
  26   26  
  27   27  /*      Copyright (c) 1988 AT&T */
  28   28  /*        All Rights Reserved   */
  29   29  
  30      -#pragma ident   "%Z%%M% %I%     %E% SMI"
  31      -
  32   30  /*
  33   31   * This stuff used to live in cook.c, but was moved out to
  34   32   * facilitate dual (Elf32 and Elf64) compilation.  See block
  35   33   * comment in cook.c for more info.
  36   34   */
  37   35  
  38   36  #include <string.h>
  39   37  #include <ar.h>
  40   38  #include <stdlib.h>
  41   39  #include <errno.h>
       40 +#include <sys/sysmacros.h>
  42   41  #include "decl.h"
  43   42  #include "member.h"
  44   43  #include "msg.h"
  45   44  
  46   45  /*
  47   46   * This module is compiled twice, the second time having
  48   47   * -D_ELF64 defined.  The following set of macros, along
  49   48   * with machelf.h, represent the differences between the
  50   49   * two compilations.  Be careful *not* to add any class-
  51   50   * dependent code (anything that has elf32 or elf64 in the
↓ open down ↓ 118 lines elided ↑ open up ↑
 170  169          d->db_scn = s;
 171  170          d->db_off = sh->sh_offset;
 172  171          d->db_data.d_align = sh->sh_addralign;
 173  172          d->db_data.d_version = elf->ed_version;
 174  173          ELFACCESSDATA(work, _elf_work)
 175  174          d->db_data.d_type = _elf_mtype(elf, sh->sh_type, work);
 176  175          d->db_data.d_buf = 0;
 177  176          d->db_data.d_off = 0;
 178  177          fsz = elf_fsize(d->db_data.d_type, 1, elf->ed_version);
 179  178          msz = _elf_msize(d->db_data.d_type, elf->ed_version);
 180      -        d->db_data.d_size = (sh->sh_size / fsz) * msz;
      179 +        d->db_data.d_size = MAX(sh->sh_size, (sh->sh_size / fsz) * msz);
 181  180          d->db_shsz = sh->sh_size;
 182  181          d->db_raw = 0;
 183  182          d->db_buf = 0;
 184  183          d->db_uflags = 0;
 185  184          d->db_myflags = 0;
 186  185          d->db_next = 0;
 187  186  
 188  187          if (sh->sh_type != SHT_NOBITS)
 189  188                  d->db_fsz = sh->sh_size;
 190  189          else
↓ open down ↓ 249 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX