The ELF64 case didn't check for overflow and accidentially used the 32bit Shdr size.
Signed-off-by: Mark Wielaard <[email protected]> --- libelf/ChangeLog | 4 ++++ libelf/elf_begin.c | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/libelf/ChangeLog b/libelf/ChangeLog index e4c5849..cf168e7 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,5 +1,9 @@ 2014-12-11 Mark Wielaard <[email protected]> + * elf_begin.c (file_read_elf): Correct ELF64 section offset check. + +2014-12-11 Mark Wielaard <[email protected]> + * elf_begin.c (read_long_names): Check for offset overflow. (__libelf_next_arhdr_wrlock): Likewise. Sanity check the ar_size. Don't allow it to go beyond end of file. diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index 99a9c0a..7fb5fa5 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -412,8 +412,8 @@ file_read_elf (int fildes, void *map_address, unsigned char *e_ident, elf->state.elf64.ehdr = ehdr; if (unlikely (ehdr->e_shoff >= maxsize) - || unlikely (ehdr->e_shoff - + scncnt * sizeof (Elf32_Shdr) > maxsize)) + || unlikely (maxsize - ehdr->e_shoff + < scncnt * sizeof (Elf64_Shdr))) goto free_and_out; elf->state.elf64.shdr = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff); -- 1.8.3.1
