diff options
| author | Nick Kralevich <nnk@google.com> | 2012-03-20 10:52:42 -0700 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2012-03-20 10:52:42 -0700 |
| commit | aac0dc97a9ad91231fa89878e745548d693366c1 (patch) | |
| tree | f6e117bc03dc1662455d4cfc8c62245e697acbb8 | |
| parent | 0814eea3ec6767e2957da9b32261ef52ec881fee (diff) | |
| parent | d73b5cafa0ef381f7c63a75e968fb7eec8e9f555 (diff) | |
| download | android_bionic-aac0dc97a9ad91231fa89878e745548d693366c1.tar.gz android_bionic-aac0dc97a9ad91231fa89878e745548d693366c1.tar.bz2 android_bionic-aac0dc97a9ad91231fa89878e745548d693366c1.zip | |
Merge "linker: fix off-by-one error in GNU_RELRO handling"
| -rw-r--r-- | linker/linker.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/linker/linker.c b/linker/linker.c index f365fb614..3a923c187 100644 --- a/linker/linker.c +++ b/linker/linker.c @@ -1030,7 +1030,7 @@ load_segments(int fd, void *header, soinfo *si) si->dynamic = (unsigned *)(base + phdr->p_vaddr); } else if (phdr->p_type == PT_GNU_RELRO) { if ((phdr->p_vaddr >= si->size) - || ((phdr->p_vaddr + phdr->p_memsz) >= si->size) + || ((phdr->p_vaddr + phdr->p_memsz) > si->size) || ((base + phdr->p_vaddr + phdr->p_memsz) < base)) { DL_ERR("%d invalid GNU_RELRO in '%s' " "p_vaddr=0x%08x p_memsz=0x%08x", pid, si->name, @@ -1779,7 +1779,7 @@ static int link_image(soinfo *si, unsigned wr_offset) si->dynamic = (unsigned *) (si->base + phdr->p_vaddr); } else if (phdr->p_type == PT_GNU_RELRO) { if ((phdr->p_vaddr >= si->size) - || ((phdr->p_vaddr + phdr->p_memsz) >= si->size) + || ((phdr->p_vaddr + phdr->p_memsz) > si->size) || ((si->base + phdr->p_vaddr + phdr->p_memsz) < si->base)) { DL_ERR("%d invalid GNU_RELRO in '%s' " "p_vaddr=0x%08x p_memsz=0x%08x", pid, si->name, |