out-of-bounds read / crash in elfutils tools (readelf, nm, ...) with malformed file

Mark Wielaard mjw at redhat.com
Fri Nov 7 11:51:15 UTC 2014


On Thu, 2014-11-06 at 10:25 -0800, Roland McGrath wrote:
> >           /* First see whether the information in the section header is
> >              valid and it does not ask for too much.  */
> >           if (unlikely (offset + size > elf->maximum_size))
> 
> This is not overflow-proof.

Missed that one. So the full fix would be as attached.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-libelf-Correct-shdr-size-check-for-raw-getdata.patch
Type: text/x-patch
Size: 3146 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20141107/109aa6ca/attachment.bin>


More information about the elfutils-devel mailing list