[COMMITTED] gelf_getnote: Check padding overflow.

[Mark Wielaard]

Since ELF notes need to be properly aligned they can include padding.
Make sure the padding itself and the padding calculation doesn't overflow.

Signed-off-by: Mark Wielaard <m...@redhat.com>
---
 libelf/ChangeLog      | 4 ++++
 libelf/gelf_getnote.c | 9 +++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 4886093..beb431f 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,5 +1,9 @@
 2014-11-16  Mark Wielaard  <m...@redhat.com>
 
+       * gelf_getnote.c (gelf_getnote): Check padding overflow.
+
+2014-11-16  Mark Wielaard  <m...@redhat.com>
+
        * elf_getdata.c (__libelf_set_rawdata_wrlock): Declare offset, size
        and align as Elf64_Off and Elf64_Xword not size_t.
 
diff --git a/libelf/gelf_getnote.c b/libelf/gelf_getnote.c
index 8bb78c1..7dc8215 100644
--- a/libelf/gelf_getnote.c
+++ b/libelf/gelf_getnote.c
@@ -73,16 +73,21 @@ gelf_getnote (data, offset, result, name_offset, 
desc_offset)
       const GElf_Nhdr *n = data->d_buf + offset;
       offset += sizeof *n;
 
+      /* Include padding.  Check below for overflow.  */
       GElf_Word namesz = NOTE_ALIGN (n->n_namesz);
       GElf_Word descsz = NOTE_ALIGN (n->n_descsz);
 
-      if (unlikely (data->d_size - offset < namesz))
+      if (unlikely (offset > data->d_size
+                   || data->d_size - offset < namesz
+                   || (namesz == 0 && n->n_namesz != 0)))
        offset = 0;
       else
        {
          *name_offset = offset;
          offset += namesz;
-         if (unlikely (data->d_size - offset < descsz))
+         if (unlikely (offset > data->d_size
+                       || data->d_size - offset < descsz
+                       || (descsz == 0 && n->n_descsz != 0)))
            offset = 0;
          else
            {
-- 
1.8.3.1