summaryrefslogtreecommitdiffstats
path: root/libdwfl
diff options
context:
space:
mode:
authorMark Wielaard <mark@klomp.org>2021-12-09 21:24:18 +0100
committerMark Wielaard <mark@klomp.org>2021-12-10 11:11:18 +0100
commit78ecba0926216e0ad90b71f789636d1e0a9777ca (patch)
treed4636aa68ea836e2a753e480a3c1f519bc6fc1dc /libdwfl
parentlibdwfl: Don't install an Elf handle in a Dwfl_Module twice (diff)
downloadelfutils-78ecba0926216e0ad90b71f789636d1e0a9777ca.tar.gz
elfutils-78ecba0926216e0ad90b71f789636d1e0a9777ca.tar.bz2
elfutils-78ecba0926216e0ad90b71f789636d1e0a9777ca.tar.xz
libdwfl: Don't try to convert too many dyns in dwfl_link_map_report
When trying to read (corrupt) dynamic entries from a core file we only want to read and convert the entries we could read. Also make sure we don't try to allocate too bug a buffer. Signed-off-by: Mark Wielaard <mark@klomp.org>
Diffstat (limited to 'libdwfl')
-rw-r--r--libdwfl/ChangeLog6
-rw-r--r--libdwfl/link_map.c14
2 files changed, 19 insertions, 1 deletions
diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog
index 1f593ac9..856bd335 100644
--- a/libdwfl/ChangeLog
+++ b/libdwfl/ChangeLog
@@ -1,3 +1,9 @@
12021-12-09 Mark Wielaard <mark@klomp.org>
2
3 * link_map.c (dwfl_link_map_report): Limit dyn_filesz malloc size
4 to max possible. When converting make sure we don't exceed the number
5 of bytes available in either in.d_buf or out.d_buf.
6
12021-12-08 Mark Wielaard <mark@klomp.org> 72021-12-08 Mark Wielaard <mark@klomp.org>
2 8
3 * dwfl_segment_report_module.c (dwfl_segment_report_module): Check 9 * dwfl_segment_report_module.c (dwfl_segment_report_module): Check
diff --git a/libdwfl/link_map.c b/libdwfl/link_map.c
index 623b3062..ad93501e 100644
--- a/libdwfl/link_map.c
+++ b/libdwfl/link_map.c
@@ -994,6 +994,17 @@ dwfl_link_map_report (Dwfl *dwfl, const void *auxv, size_t auxv_size,
994 if ((*memory_callback) (dwfl, dyn_segndx, &in.d_buf, &in.d_size, 994 if ((*memory_callback) (dwfl, dyn_segndx, &in.d_buf, &in.d_size,
995 dyn_vaddr, dyn_filesz, memory_callback_arg)) 995 dyn_vaddr, dyn_filesz, memory_callback_arg))
996 { 996 {
997 size_t entsize = (elfclass == ELFCLASS32
998 ? sizeof (Elf32_Dyn) : sizeof (Elf64_Dyn));
999 if (unlikely (dyn_filesz > SIZE_MAX / entsize))
1000 {
1001 __libdwfl_seterrno (DWFL_E_NOMEM);
1002 return false;
1003 }
1004 /* We can only process as many bytes as there are in
1005 in.d_size. The data might have been truncated. */
1006 if (dyn_filesz > in.d_size)
1007 dyn_filesz = in.d_size;
997 void *buf = malloc (dyn_filesz); 1008 void *buf = malloc (dyn_filesz);
998 Elf32_Dyn (*d32)[dyn_filesz / sizeof (Elf32_Dyn)] = buf; 1009 Elf32_Dyn (*d32)[dyn_filesz / sizeof (Elf32_Dyn)] = buf;
999 Elf64_Dyn (*d64)[dyn_filesz / sizeof (Elf64_Dyn)] = buf; 1010 Elf64_Dyn (*d64)[dyn_filesz / sizeof (Elf64_Dyn)] = buf;
@@ -1009,7 +1020,8 @@ dwfl_link_map_report (Dwfl *dwfl, const void *auxv, size_t auxv_size,
1009 .d_size = dyn_filesz, 1020 .d_size = dyn_filesz,
1010 .d_buf = buf 1021 .d_buf = buf
1011 }; 1022 };
1012 in.d_size = out.d_size; 1023 if (in.d_size > out.d_size)
1024 in.d_size = out.d_size;
1013 if (likely ((elfclass == ELFCLASS32 1025 if (likely ((elfclass == ELFCLASS32
1014 ? elf32_xlatetom : elf64_xlatetom) 1026 ? elf32_xlatetom : elf64_xlatetom)
1015 (&out, &in, elfdata) != NULL)) 1027 (&out, &in, elfdata) != NULL))