diff options
| author | Ed Maste <emaste@FreeBSD.org> | 2014-12-29 20:23:42 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2014-12-29 20:23:42 +0000 |
| commit | 3a6f20c19a046f3f6b1d87f9a0d2ee646e6339e6 (patch) | |
| tree | 1f1fa2265c995616a3a54fd4804ba4a0c5e3e464 | |
| parent | 2013b96e58cc608382ffa7818cffd5173742027b (diff) | |
Notes
| -rw-r--r-- | contrib/elftoolchain/libelf/elf_scn.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/contrib/elftoolchain/libelf/elf_scn.c b/contrib/elftoolchain/libelf/elf_scn.c index f80711579d597..60e9ded7ecef9 100644 --- a/contrib/elftoolchain/libelf/elf_scn.c +++ b/contrib/elftoolchain/libelf/elf_scn.c @@ -50,6 +50,7 @@ _libelf_load_section_headers(Elf *e, void *ehdr) Elf64_Ehdr *eh64; int ec, swapbytes; unsigned char *src; + unsigned char *rawend; size_t fsz, i, shnum; int (*xlator)(unsigned char *_d, size_t _dsz, unsigned char *_s, size_t _c, int _swap); @@ -86,6 +87,7 @@ _libelf_load_section_headers(Elf *e, void *ehdr) swapbytes = e->e_byteorder != LIBELF_PRIVATE(byteorder); src = e->e_rawfile + shoff; + rawend = e->e_rawfile + e->e_rawsize; /* * If the file is using extended numbering then section #0 @@ -102,6 +104,8 @@ _libelf_load_section_headers(Elf *e, void *ehdr) } for (; i < shnum; i++, src += fsz) { + if (src + sizeof(scn->s_shdr) > rawend) + return (0); if ((scn = _libelf_allocate_scn(e, i)) == NULL) return (0); |