diff options
| author | Mark Wielaard <mjw@redhat.com> | 2015-05-12 15:16:35 +0200 |
|---|---|---|
| committer | Mark Wielaard <mjw@redhat.com> | 2015-05-18 15:48:04 +0200 |
| commit | 458027d294ac6e8a8678d9fd0f96759d7196ae2b (patch) | |
| tree | 0bf45258723e135483b0c9573f966f94bf70ce4d /libelf | |
| parent | 987e3d722d1d3879c51f4ed7ab1da03a75f5f38c (diff) | |
| download | android_external_elfutils-458027d294ac6e8a8678d9fd0f96759d7196ae2b.tar.gz android_external_elfutils-458027d294ac6e8a8678d9fd0f96759d7196ae2b.tar.bz2 android_external_elfutils-458027d294ac6e8a8678d9fd0f96759d7196ae2b.zip | |
libelf: Make sure shdrs are valid before storing extended phnum in newphdr.
Creating phdr with more than PN_XNUM phnum requires a valid section zero
shdr to store the extended value. Make sure the shdrs are valid. Also fix
the error when count was too big to store by setting ELF_E_INVALID_INDEX
before failing.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Diffstat (limited to 'libelf')
| -rw-r--r-- | libelf/ChangeLog | 6 | ||||
| -rw-r--r-- | libelf/elf32_newphdr.c | 12 |
2 files changed, 17 insertions, 1 deletions
diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 312d5cfb..a7983a0a 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,9 @@ +2015-05-12 Mark Wielaard <mjw@redhat.com> + + * elf32_newphdr.c (newphdr): Call __libelf_seterrno with + ELF_E_INVALID_INDEX before failing. Check whether section zero shdr + actually exists if we need to put extended phnum in section zero. + 2015-05-08 Mark Wielaard <mjw@redhat.com> * nlist.c (nlist): Call gelf_fsize with EV_CURRENT. diff --git a/libelf/elf32_newphdr.c b/libelf/elf32_newphdr.c index 01038e73..f89153b4 100644 --- a/libelf/elf32_newphdr.c +++ b/libelf/elf32_newphdr.c @@ -116,6 +116,17 @@ elfw2(LIBELFBITS,newphdr) (elf, count) { if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr)))) { + __libelf_seterrno (ELF_E_INVALID_INDEX); + result = NULL; + goto out; + } + + Elf_Scn *scn0 = &elf->state.ELFW(elf,LIBELFBITS).scns.data[0]; + if (unlikely (count >= PN_XNUM && scn0->shdr.ELFW(e,LIBELFBITS) == NULL)) + { + /* Something is wrong with section zero, but we need it to write + the extended phdr count. */ + __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER); result = NULL; goto out; } @@ -134,7 +145,6 @@ elfw2(LIBELFBITS,newphdr) (elf, count) if (count >= PN_XNUM) { /* We have to write COUNT into the zeroth section's sh_info. */ - Elf_Scn *scn0 = &elf->state.ELFW(elf,LIBELFBITS).scns.data[0]; if (elf->state.ELFW(elf,LIBELFBITS).scns.cnt == 0) { assert (elf->state.ELFW(elf,LIBELFBITS).scns.max > 0); |