From patchwork Wed Dec 15 23:40:57 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Wielaard X-Patchwork-Id: 48995 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 2F37E3858414 for ; Wed, 15 Dec 2021 23:41:08 +0000 (GMT) X-Original-To: elfutils-devel@sourceware.org Delivered-To: elfutils-devel@sourceware.org Received: from gnu.wildebeest.org (gnu.wildebeest.org [45.83.234.184]) by sourceware.org (Postfix) with ESMTPS id 69C983858D28 for ; Wed, 15 Dec 2021 23:41:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 69C983858D28 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=klomp.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=klomp.org Received: from reform (deer0x12.wildebeest.org [172.31.17.148]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gnu.wildebeest.org (Postfix) with ESMTPSA id F2EFF302FBA5; Thu, 16 Dec 2021 00:40:59 +0100 (CET) Received: by reform (Postfix, from userid 1000) id 886EF2E83743; Thu, 16 Dec 2021 00:40:59 +0100 (CET) From: Mark Wielaard To: elfutils-devel@sourceware.org Subject: [PATCH] libdwfl: Make sure phent is sane and there is at least one phdr Date: Thu, 16 Dec 2021 00:40:57 +0100 Message-Id: <20211215234057.669569-1-mark@klomp.org> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-Spam-Status: No, score=-9.8 required=5.0 tests=BAYES_00, GIT_PATCH_0, JMQ_SPF_NEUTRAL, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , Cc: Mark Wielaard Errors-To: elfutils-devel-bounces+patchwork=sourceware.org@sourceware.org Sender: "Elfutils-devel" dwfl_link_map_report can only handle program headers that are the correct (32 or 64 bit) size. The buffer read in needs to contain room for at least one Phdr. https://sourceware.org/bugzilla/show_bug.cgi?id=28660 Signed-off-by: Mark Wielaard --- libdwfl/ChangeLog | 6 ++++++ libdwfl/link_map.c | 16 ++++++++++++++-- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog index aaea164c..7bf789e0 100644 --- a/libdwfl/ChangeLog +++ b/libdwfl/ChangeLog @@ -1,3 +1,9 @@ +2021-12-15 Mark Wielaard + + * link_map.c (dwfl_link_map_report): Make sure phent is either sizeof + Elf32_Phdr or sizeof Elf64_Phdr. Check in.d_size can hold at least one + Phdr. + 2021-12-12 Mark Wielaard * dwfl_segment_report_module.c (dwfl_segment_report_module): Don't diff --git a/libdwfl/link_map.c b/libdwfl/link_map.c index ad93501e..82df7b69 100644 --- a/libdwfl/link_map.c +++ b/libdwfl/link_map.c @@ -1,5 +1,6 @@ /* Report modules by examining dynamic linker data structures. Copyright (C) 2008-2016 Red Hat, Inc. + Copyright (C) 2021 Mark J. Wielaard This file is part of elfutils. This file is free software; you can redistribute it and/or modify @@ -784,7 +785,9 @@ dwfl_link_map_report (Dwfl *dwfl, const void *auxv, size_t auxv_size, GElf_Xword dyn_filesz = 0; GElf_Addr dyn_bias = (GElf_Addr) -1; - if (phdr != 0 && phnum != 0 && phent != 0) + if (phdr != 0 && phnum != 0 + && ((elfclass == ELFCLASS32 && phent == sizeof (Elf32_Phdr)) + || (elfclass == ELFCLASS64 && phent == sizeof (Elf64_Phdr)))) { Dwfl_Module *phdr_mod; int phdr_segndx = INTUSE(dwfl_addrsegment) (dwfl, phdr, &phdr_mod); @@ -904,7 +907,16 @@ dwfl_link_map_report (Dwfl *dwfl, const void *auxv, size_t auxv_size, .d_buf = buf }; if (in.d_size > out.d_size) - in.d_size = out.d_size; + { + in.d_size = out.d_size; + phnum = in.d_size / phent; + if (phnum == 0) + { + free (buf); + __libdwfl_seterrno (DWFL_E_BADELF); + return false; + } + } if (likely ((elfclass == ELFCLASS32 ? elf32_xlatetom : elf64_xlatetom) (&out, &in, elfdata) != NULL))