readelf: Fix bounds check in print_form_data.
authorMark Wielaard <mark@klomp.org>
Mon, 11 Jun 2018 00:14:34 +0000 (02:14 +0200)
committerMark Wielaard <mark@klomp.org>
Mon, 11 Jun 2018 15:51:13 +0000 (17:51 +0200)
commit01044a9ed1d58bedb5d7f96f8ff40134d127a6d1
tree6a365fda43536edab8320a25cacd781eb5edbef9
parent340ce2c433b8033e57c0c23e9087ea15a349fd3e
readelf: Fix bounds check in print_form_data.

The afl fuzzer found that we did a wrong check in print_form_data when
comparing the remaining bytes in the buffer to an (unsigned) value read.
We were casting the value to ptrdiff_t which is a signed value and so
might turn a really big unsigned value into a negative number. Since we
know the difference between readendp and readp is zero or greater, we
should cast the pointer difference to size_t (and unsigned type) instead
before comparing with the unsigned value.

Signed-off-by: Mark Wielaard <mark@klomp.org>
src/ChangeLog
src/readelf.c