vapier 15/02/22 00:10:27 Modified: scanelf.c Log: scanelf: improve shdr string overflow check more Rather than operate on the result of the pointers (which might have overflowed due to the offset being huge), check the offset directly against the size of the file like we do elsewhere in scanelf.
Revision Changes Path 1.271 pax-utils/scanelf.c file : http://sources.gentoo.org/viewvc.cgi/gentoo-projects/pax-utils/scanelf.c?rev=1.271&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-projects/pax-utils/scanelf.c?rev=1.271&content-type=text/plain diff : http://sources.gentoo.org/viewvc.cgi/gentoo-projects/pax-utils/scanelf.c?r1=1.270&r2=1.271 Index: scanelf.c =================================================================== RCS file: /var/cvsroot/gentoo-projects/pax-utils/scanelf.c,v retrieving revision 1.270 retrieving revision 1.271 diff -u -r1.270 -r1.271 --- scanelf.c 21 Feb 2015 19:30:59 -0000 1.270 +++ scanelf.c 22 Feb 2015 00:10:27 -0000 1.271 @@ -1,13 +1,13 @@ /* * Copyright 2003-2012 Gentoo Foundation * Distributed under the terms of the GNU General Public License v2 - * $Header: /var/cvsroot/gentoo-projects/pax-utils/scanelf.c,v 1.270 2015/02/21 19:30:59 vapier Exp $ + * $Header: /var/cvsroot/gentoo-projects/pax-utils/scanelf.c,v 1.271 2015/02/22 00:10:27 vapier Exp $ * * Copyright 2003-2012 Ned Ludd - <[email protected]> * Copyright 2004-2012 Mike Frysinger - <[email protected]> */ -static const char rcsid[] = "$Id: scanelf.c,v 1.270 2015/02/21 19:30:59 vapier Exp $"; +static const char rcsid[] = "$Id: scanelf.c,v 1.271 2015/02/22 00:10:27 vapier Exp $"; const char argv0[] = "scanelf"; #include "paxinc.h" @@ -431,7 +431,6 @@ /* no program headers which means this is prob an object file */ \ Elf ## B ## _Shdr *shdr = SHDR ## B (elf->shdr); \ Elf ## B ## _Shdr *strtbl = shdr + EGET(ehdr->e_shstrndx); \ - char *str; \ if ((void*)strtbl > elf->data_end) \ goto skip_this_shdr##B; \ /* let's flag -w/+x object files since the final ELF will most likely \ @@ -442,9 +441,9 @@ for (i = 0; i < EGET(ehdr->e_shnum); ++i) { \ if (EGET(shdr[i].sh_type) != SHT_PROGBITS) continue; \ offset = EGET(strtbl->sh_offset) + EGET(shdr[i].sh_name); \ - str = elf->data + offset; \ - if (str + sizeof(NOTE_GNU_STACK) > elf->data + elf->len) continue; \ - if (!strcmp(str, NOTE_GNU_STACK)) { \ + if (offset >= elf->len - sizeof(NOTE_GNU_STACK)) \ + continue; \ + if (!strcmp(elf->data + offset, NOTE_GNU_STACK)) { \ if (multi_stack++) warnf("%s: multiple .note.GNU-stack's !?", elf->filename); \ flags = EGET(shdr[i].sh_flags); \ if (be_quiet && ((flags & check_flags) != check_flags)) \
