parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and
the other DT_* tables come from the module unchecked. Check them
against the mapping, and reject a size without its table.
Reported by: llm-postcr
MFC after: 1 week
Differential D61387
link_elf: bounds-check the dynamic section's tables Authored by ojanerif_amd.com on Tue, Nov 10, 1:03 PM.
Details parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and Reported by: llm-postcr
Diff Detail
|