D61338.1794319743.diff
No OneTemporary
Actions

Authored By

Unknown

Size

1 KB

Referenced Files

None

Subscribers

None

D61338.1794319743.diff
View Options

	diff --git a/sys/kern/link_elf_obj.c b/sys/kern/link_elf_obj.c
	--- a/sys/kern/link_elf_obj.c
	+++ b/sys/kern/link_elf_obj.c
	@@ -359,6 +359,27 @@
	return (0);
	}

	+static int
	+link_elf_obj_check_shstrtab(elf_file_t ef, const Elf_Shdr *shdr, int shnum,
	+ const char *filename)
	+{
	+ int i;
	+
	+ if (ef->shstrtab == NULL)
	+ return (0);
	+ if (ef->shstrcnt == 0 \|\| ef->shstrtab[ef->shstrcnt - 1] != '\0') {
	+ link_elf_error(filename, "corrupt section name string table");
	+ return (ENOEXEC);
	+ }
	+ for (i = 0; i < shnum; i++) {
	+ if (shdr[i].sh_name >= ef->shstrcnt) {
	+ link_elf_error(filename, "corrupt section name offset");
	+ return (ENOEXEC);
	+ }
	+ }
	+ return (0);
	+}
	+
	static int
	link_elf_link_preload(linker_class_t cls, const char *filename,
	linker_file_t *result)
	@@ -507,6 +528,9 @@
	goto out;
	ef->shstrcnt = shdr[shstrindex].sh_size;
	ef->shstrtab = (char *)shdr[shstrindex].sh_addr;
	+ error = link_elf_obj_check_shstrtab(ef, shdr, hdr->e_shnum, filename);
	+ if (error != 0)
	+ goto out;

	/* Now fill out progtab and the relocation tables. */
	pb = 0;
	@@ -1000,6 +1024,9 @@
	goto out;
	}
	}
	+ error = link_elf_obj_check_shstrtab(ef, shdr, hdr->e_shnum, filename);
	+ if (error != 0)
	+ goto out;

	/* Size up code/data(progbits) and bss(nobits). */
	alignmask = 0;