Print this page
5535 libelf should check for e_phoff overflow

Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/sgs/libelf/common/clscook.c
          +++ new/usr/src/cmd/sgs/libelf/common/clscook.c
↓ open down ↓ 306 lines elided ↑ open up ↑
 307  307          fsz = elf_fsize(ELF_T_PHDR, 1, elf->ed_version);
 308  308          if (eh->e_phentsize != fsz) {
 309  309                  _elf_seterr(EFMT_PHDRSZ, 0);
 310  310                  return (-1);
 311  311          }
 312  312  
 313  313          fsz *= eh->e_phnum;
 314  314          ELFACCESSDATA(work, _elf_work)
 315  315          msz = _elf_msize(ELF_T_PHDR, work) * eh->e_phnum;
 316  316          if ((eh->e_phoff == 0) ||
 317      -            ((fsz + eh->e_phoff) > elf->ed_fsz)) {
      317 +            (elf->ed_fsz <= eh->e_phoff) ||
      318 +            (elf->ed_fsz - eh->e_phoff < fsz)) {
 318  319                  _elf_seterr(EFMT_PHTAB, 0);
 319  320                  return (-1);
 320  321          }
 321  322  
 322  323          if (inplace && fsz >= msz && eh->e_phoff % sizeof (ElfField) == 0) {
 323  324                  elf->ed_phdr = (Elf_Void *)(elf->ed_ident + eh->e_phoff);
 324  325                  elf->ed_status = ES_COOKED;
 325  326          } else {
 326  327                  if ((elf->ed_phdr = malloc(msz)) == 0) {
 327  328                          _elf_seterr(EMEM_PHDR, errno);
↓ open down ↓ 111 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX