upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-11 09:41:03 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix several issues with parsing the notes for ELF objects.

Browse source 
Badly formed ELF note may cause the caclulated pointer to the next note
to point both after the note region, that was checked in the code, but
also to point before the region, that was not checked [1]. Remember the
first note location in note0 and leap out if the note is not between
note0 and note_end.

In the similar way, badly formed note may cause infinite loop by
pointing next note into the same or previous note. Guard against this by
limiting amount of loop iterations by arbitrary choosen big number.

For clarity, check the calculated note alignment in each iteration.

Reported by:	Chris Palmer <chris noncombatant org> [1]
PR:	kern/132886
Reviewed and tested by:	dchagin
MFC after:	3 days
This commit is contained in:
Konstantin Belousov 2009-03-22 13:42:41 +00:00
parent e952f9cf75
commit 267c52fc98
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
sys/kern/imgact_elf.c
View file

@ -1331,7 +1331,7 @@ static boolean_t
__elfN(check_note)(struct image_params *imgp, Elf_Brandnote *checknote,
int32_t *osrel)
{
const Elf_Note *note, *note_end;
const Elf_Note *note, *note0, *note_end;
const Elf_Phdr *phdr, *pnote;
const Elf_Ehdr *hdr;
const char *note_name;
@ -1352,12 +1352,12 @@ __elfN(check_note)(struct image_params *imgp, Elf_Brandnote *checknote,
pnote->p_offset + pnote->p_filesz >= PAGE_SIZE)
return (FALSE);
note = (const Elf_Note *)(imgp->image_header + pnote->p_offset);
if (!aligned(note, Elf32_Addr))
return (FALSE);
note = note0 = (const Elf_Note *)(imgp->image_header + pnote->p_offset);
note_end = (const Elf_Note *)(imgp->image_header +
pnote->p_offset + pnote->p_filesz);
while (note < note_end) {
for (i = 0; i < 100 && note >= note0 && note < note_end; i++) {
if (!aligned(note, Elf32_Addr))
return (FALSE);
if (note->n_namesz != checknote->hdr.n_namesz ||
note->n_descsz != checknote->hdr.n_descsz ||
note->n_type != checknote->hdr.n_type)