libelf: Make sure we have at least a full ELF header available.

When elf_memory is called we could get a slightly too small image
that doesn't contain a full ELF header (but does contain at least
the e_ident values). Require the full header before even validating
the rest of the ELF header fields.

https://sourceware.org/bugzilla/show_bug.cgi?id=27076

Signed-off-by: Mark Wielaard <mark@klomp.org>

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 41727fb..a280a26 100644 (file)
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,7 @@
+2020-12-15  Mark Wielaard  <mark@klomp.org>
+
+       * elf_begin.c (get_shnum): Make sure the full Ehdr is available.
+
 2020-12-12  Dmitry V. Levin  <ldv@altlinux.org>
 
        * common.h: Fix spelling typo in comment.

diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c
index 43828c9..32648c1 100644 (file)
--- a/libelf/elf_begin.c
+++ b/libelf/elf_begin.c
@@ -88,6 +88,13 @@ get_shnum (void *map_address, unsigned char *e_ident, int fildes,
   } ehdr_mem;
   bool is32 = e_ident[EI_CLASS] == ELFCLASS32;
 
+  if ((is32 && maxsize < sizeof (Elf32_Ehdr))
+      || (!is32 && maxsize < sizeof (Elf64_Ehdr)))
+    {
+       __libelf_seterrno (ELF_E_INVALID_ELF);
+      return (size_t) -1l;
+    }
+
   /* Make the ELF header available.  */
   if (e_ident[EI_DATA] == MY_ELFDATA
       && (ALLOW_UNALIGNED