From 012018907ca05eb0ab51d424a596ef38fc87cae1 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Wed, 16 Jan 2019 11:57:35 +0100 Subject: [PATCH] libebl: Check GNU property note pr_datasz fits inside note description. Before printing the data values, make sure pr_datasz doesn't go beyond the end of the note description data. https://sourceware.org/bugzilla/show_bug.cgi?id=24075 Signed-off-by: Mark Wielaard --- libebl/ChangeLog | 4 ++++ libebl/eblobjnote.c | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/libebl/ChangeLog b/libebl/ChangeLog index 0174f33..77c2274 100644 --- a/libebl/ChangeLog +++ b/libebl/ChangeLog @@ -1,3 +1,7 @@ +2019-01-16 Mark Wielaard + + * eblobjnte.c (ebl_object_note): Check pr_datasz isn't too large. + 2018-12-02 Mark Wielaard * eblobjnte.c (ebl_object_note): For GNU_PROPERTY_STACK_SIZE use diff --git a/libebl/eblobjnote.c b/libebl/eblobjnote.c index c19ea37..9094715 100644 --- a/libebl/eblobjnote.c +++ b/libebl/eblobjnote.c @@ -350,6 +350,13 @@ ebl_object_note (Ebl *ebl, uint32_t namesz, const char *name, uint32_t type, desc += 8; descsz -= 8; + if (prop.pr_datasz > descsz) + { + printf ("BAD property datasz: %" PRId32 "\n", + prop.pr_datasz); + return; + } + int elfclass = gelf_getclass (ebl->elf); char *elfident = elf_getident (ebl->elf, NULL); GElf_Ehdr ehdr; -- 2.7.4