Hi,
if you run jankratochvil/gdbserver as:
./gdbserver 1234 corefile
without this change it prints:
./gdbserver: Error reading note at core file offset 0x468
due to:
81 if (unlikely (size > elf->maximum_size
82 || (off64_t) (elf->maximum_size - size) < offset))
(gdb) p size > elf->maximum_size
$6 = 0
(gdb) p (off64_t) (elf->maximum_size - size) < offset
$7 = 1
(gdb) p offset
$10 = 1128
(gdb) p (off64_t) (elf->maximum_size - size)
$8 = -1369
(gdb) p elf->maximum_size - size
$9 = 18446744073709550247
(gdb) p/x elf->maximum_size
$11 = 0xffffffffffffffff
In fact I believe Elf->maximum_size should be off64_t and not size_t as this
way 32bit hosts cannot handle >2GB ELF files, can they? But as 32bit hosts
are dead I did not try to do the more invasive change.
OK to merge to master? It is now in <jankratochvil/pending>.
No regressions on {x86_64,i686}-fedora13-linux-gnu.
Thanks,
Jan
libelf/
2010-12-19 Jan Kratochvil <jan.kratochvil(a)redhat.com>
* elf_getdata_rawchunk.c (elf_getdata_rawchunk): Fix off64_t overflow
when MAXIMUM_SIZE == ~0.
--- a/libelf/elf_getdata_rawchunk.c
+++ b/libelf/elf_getdata_rawchunk.c
@@ -78,8 +78,8 @@ elf_getdata_rawchunk (elf, offset, size, type)
return NULL;
}
- if (unlikely (size > elf->maximum_size
- || (off64_t) (elf->maximum_size - size) < offset))
+ if (unlikely (offset < 0 || offset + (off64_t) size < offset
+ || offset + size > elf->maximum_size))
{
/* Invalid request. */
__libelf_seterrno (ELF_E_INVALID_OP);
Show replies by thread