elf_getshdrstrndx tries to get at section zero if e_shstrndx is
SHN_XINDEX and section zero hasn't been read in yet (when e_shstrndx
is set to SHN_XINDEX the real strndx is found in section zero
sh_link). While doing that it should check that e_shoff (offset) is
actually inside the Elf image.
* libelf/elf_getshdrstrndx.c (elf_getshdrstrndx): Check offset
fits elf->maximum_size.
Signed-off-by: Mark Wielaard <[email protected]>
---
libelf/elf_getshdrstrndx.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libelf/elf_getshdrstrndx.c b/libelf/elf_getshdrstrndx.c
index af9c3a1479fd..424e7adc1459 100644
--- a/libelf/elf_getshdrstrndx.c
+++ b/libelf/elf_getshdrstrndx.c
@@ -112,8 +112,9 @@ elf_getshdrstrndx (Elf *elf, size_t *dst)
{
/* First see whether the information in the ELF header is
valid and it does not ask for too much. */
- if (unlikely (elf->maximum_size - offset
- < sizeof (Elf32_Shdr)))
+ if (unlikely (offset > elf->maximum_size
+ || (elf->maximum_size - offset
+ < sizeof (Elf32_Shdr))))
{
/* Something is wrong. */
__libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
@@ -177,8 +178,9 @@ elf_getshdrstrndx (Elf *elf, size_t *dst)
{
/* First see whether the information in the ELF header is
valid and it does not ask for too much. */
- if (unlikely (elf->maximum_size - offset
- < sizeof (Elf64_Shdr)))
+ if (unlikely (offset > elf->maximum_size
+ || (elf->maximum_size - offset
+ < sizeof (Elf64_Shdr))))
{
/* Something is wrong. */
__libelf_seterrno (ELF_E_INVALID_SECTION_HEADER);
--
2.56.0
