Reported-by: Florian Weimer fweimer@redhat.com Signed-off-by: Mark Wielaard mjw@redhat.com --- src/ChangeLog | 4 ++++ src/nm.c | 5 +++++ 2 files changed, 9 insertions(+)
diff --git a/src/ChangeLog b/src/ChangeLog index fb9c776..f74b5dc 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,7 @@ +2016-03-21 Mark Wielaard mjw@redhat.com + + * nm.c (show_symbols): Check for malloc size argument overflow. + 2016-02-13 Mark Wielaard mjw@redhat.com
* readelf.c (print_scngrp): Call error when gelf_getshdr fails. diff --git a/src/nm.c b/src/nm.c index 2911afa..20edd65 100644 --- a/src/nm.c +++ b/src/nm.c @@ -1311,6 +1311,11 @@ show_symbols (int fd, Ebl *ebl, GElf_Ehdr *ehdr, XXX We can use a dirty trick here. Since GElf_Sym == Elf64_Sym we can use the data memory instead of copying again if what we read is a 64 bit file. */ + if (nentries > SIZE_MAX / sizeof (GElf_SymX)) + error (0, 0, + gettext ("%s: entries (%zd) in section %zd `%s' is too large"), + fullname, nentries, elf_ndxscn (scn), + elf_strptr (ebl->elf, shstrndx, shdr->sh_name)); GElf_SymX *sym_mem; if (nentries * sizeof (GElf_SymX) < MAX_STACK_ALLOC) sym_mem = (GElf_SymX *) alloca (nentries * sizeof (GElf_SymX));
On Mon, 2016-03-21 at 16:03 +0100, Mark Wielaard wrote:
- if (nentries > SIZE_MAX / sizeof (GElf_SymX))
- error (0, 0,
Oops. We don't just want to print a warning here. We want to report an EXIT_FAILURE on error. Fixed patch attached.
On Mon, 2016-03-21 at 16:12 +0100, Mark Wielaard wrote:
On Mon, 2016-03-21 at 16:03 +0100, Mark Wielaard wrote:
- if (nentries > SIZE_MAX / sizeof (GElf_SymX))
- error (0, 0,
Oops. We don't just want to print a warning here. We want to report an EXIT_FAILURE on error. Fixed patch attached.
I pushed this fixed patch to master now.
elfutils-devel@lists.fedorahosted.org