diff mbox series

[08/10] libsframe: check for overflow in sframe_fde_tbl_alloc

Message ID 20260827224146.3391610-9-ibhagatgnu@gmail.com
State New
Headers
Series fix two PRs and guard against bad data |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_binutils_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_binutils_build--master-arm success Build passed
linaro-tcwg-bot/tcwg_binutils_check--master-aarch64 success Test passed
linaro-tcwg-bot/tcwg_binutils_check--master-arm success Test passed

Commit Message

Indu Bhagat Aug. 27, 2026, 10:41 p.m. UTC 
  sframe_fde_tbl_alloc() allocated memory for internal FDE entries based
on num_fdes * sizeof(sframe_func_desc_entry_int). If num_fdes was very
large (malicious input data), integer overflow could occur during size
calculation, producing a smaller allocation and resulting in potential
buffer overflow.

This addresses some concerns raised in the PR libsframe/34273.
---
 libsframe/sframe.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Jens Remus Sept. 7, 2026, 12:46 p.m. UTC | #1 
On 8/28/2026 12:41 AM, Indu Bhagat wrote:
> sframe_fde_tbl_alloc() allocated memory for internal FDE entries based
> on num_fdes * sizeof(sframe_func_desc_entry_int). If num_fdes was very
> large (malicious input data), integer overflow could occur during size
> calculation, producing a smaller allocation and resulting in potential
> buffer overflow.
> 
> This addresses some concerns raised in the PR libsframe/34273.
> ---
>  libsframe/sframe.c | 6 ++++++
>  1 file changed, 6 insertions(+)

Reviewed-by: Jens Remus <jremus@linux.ibm.com>

> diff --git a/libsframe/sframe.c b/libsframe/sframe.c

> @@ -124,6 +124,12 @@ sframe_ret_set_errno (int *errp, int error)
>  static int
>  sframe_fde_tbl_alloc (sf_fde_tbl **fde_tbl, unsigned int num_fdes)
>  {
> +  size_t max_num_fdes = ((SIZE_MAX - sizeof (sf_fde_tbl))
> +			 / sizeof (sframe_func_desc_entry_int));
> +
> +  if ((size_t) num_fdes > max_num_fdes)

Nit: Is that cast to (size_t) required here?

> +    return SFRAME_ERR;
> +
>    size_t fidx_size = num_fdes * sizeof (sframe_func_desc_entry_int);
>    size_t fd_tbl_sz = (sizeof (sf_fde_tbl) + fidx_size);
>  

Regards,
Jens
diff mbox series

Patch

diff --git a/libsframe/sframe.c b/libsframe/sframe.c
index f047342a782..5ddd3962212 100644
--- a/libsframe/sframe.c
+++ b/libsframe/sframe.c
@@ -124,6 +124,12 @@  sframe_ret_set_errno (int *errp, int error)
 static int
 sframe_fde_tbl_alloc (sf_fde_tbl **fde_tbl, unsigned int num_fdes)
 {
+  size_t max_num_fdes = ((SIZE_MAX - sizeof (sf_fde_tbl))
+			 / sizeof (sframe_func_desc_entry_int));
+
+  if ((size_t) num_fdes > max_num_fdes)
+    return SFRAME_ERR;
+
   size_t fidx_size = num_fdes * sizeof (sframe_func_desc_entry_int);
   size_t fd_tbl_sz = (sizeof (sf_fde_tbl) + fidx_size);