openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-04-16 10:14:35 +00:00
Code Issues Projects Releases Wiki Activity

Range-check fields inside the file to ensure they don't exceed the size

Browse Source 
of the file and cause later crashes.
from renaud allard
This commit is contained in:
deraadt
2026-04-01 16:58:22 +00:00
parent 471a995e78
commit dc8703adcd
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
usr.bin/gprof/elf.c
View File

@@ -74,6 +74,10 @@ getnfile(const char *filename, char ***defaultEs)
close(fd);
base = (const char *)mapbase;
if (h.e_shoff >= s.st_size ||
h.e_shoff + (off_t)h.e_shnum * sizeof(Elf_Shdr) > s.st_size)
errx(1, "%s: bad section header offset", filename);
shdrs = (const Elf_Shdr *)(base + h.e_shoff);
/* Find the symbol table and associated string table section. */
@@ -83,8 +87,14 @@ getnfile(const char *filename, char ***defaultEs)
if (i == h.e_shnum)
errx(1, "%s has no symbol table", filename);
sh_symtab = &shdrs[i];
if (sh_symtab->sh_link >= h.e_shnum)
errx(1, "%s: bad string table link", filename);
sh_strtab = &shdrs[sh_symtab->sh_link];
if (sh_symtab->sh_offset >= s.st_size ||
sh_symtab->sh_entsize == 0 ||
sh_strtab->sh_offset >= s.st_size)
errx(1, "%s: bad symbol table", filename);
symtab = (const Elf_Sym *)(base + sh_symtab->sh_offset);
symtabct = sh_symtab->sh_size / sh_symtab->sh_entsize;
strtab = (const char *)(base + sh_strtab->sh_offset);