D61322.1794349726.diff
No OneTemporary
Actions

Authored By

Unknown

Size

1 KB

Referenced Files

None

Subscribers

None

D61322.1794349726.diff
View Options

	diff --git a/sys/kern/link_elf_obj.c b/sys/kern/link_elf_obj.c
	--- a/sys/kern/link_elf_obj.c
	+++ b/sys/kern/link_elf_obj.c
	@@ -340,6 +340,25 @@
	round_page((vm_offset_t)ef->address + ef->lf.size), gapprot);
	}

	+static int
	+link_elf_obj_check_symtab(elf_file_t ef, const char *filename)
	+{
	+ const Elf_Sym *symp;
	+ long i;
	+
	+ if (ef->ddbstrcnt == 0 \|\| ef->ddbstrtab[ef->ddbstrcnt - 1] != '\0') {
	+ link_elf_error(filename, "corrupt symbol string table");
	+ return (ENOEXEC);
	+ }
	+ for (i = 0, symp = ef->ddbsymtab; i < ef->ddbsymcnt; i++, symp++) {
	+ if (symp->st_name >= ef->ddbstrcnt) {
	+ link_elf_error(filename, "corrupt symbol name offset");
	+ return (ENOEXEC);
	+ }
	+ }
	+ return (0);
	+}
	+
	static int
	link_elf_link_preload(linker_class_t cls, const char *filename,
	linker_file_t *result)
	@@ -483,6 +502,9 @@
	ef->ddbsymtab = (Elf_Sym *)shdr[symtabindex].sh_addr;
	ef->ddbstrcnt = shdr[symstrindex].sh_size;
	ef->ddbstrtab = (char *)shdr[symstrindex].sh_addr;
	+ error = link_elf_obj_check_symtab(ef, filename);
	+ if (error != 0)
	+ goto out;
	ef->shstrcnt = shdr[shstrindex].sh_size;
	ef->shstrtab = (char *)shdr[shstrindex].sh_addr;

	@@ -949,6 +971,9 @@
	error = EINVAL;
	goto out;
	}
	+ error = link_elf_obj_check_symtab(ef, filename);
	+ if (error != 0)
	+ goto out;

	/* Do we have a string table for the section names? */
	if (hdr->e_shstrndx >= hdr->e_shnum) {