[PATCH] CVE-2014-0172 Check for overflow before calling malloc to uncompress data.

Florian Weimer fweimer at redhat.com
Wed Apr 9 15:07:17 UTC 2014


On 04/09/2014 01:57 PM, Mark Wielaard wrote:

> +	    /* Check for unsigned overflow so malloc always allocated
> +	       enough memory for both the Elf_Data header and the
> +	       uncompressed section data.  */
> +	    if (unlikely (sizeof (Elf_Data) + size < size))
> +	      break;
> +

Looks good to me.

-- 
Florian Weimer / Red Hat Product Security Team


More information about the elfutils-devel mailing list