Page MenuHomeFreeBSD
Files F177446855

D61388.1794420879.diff
No OneTemporary
Actions

Authored By
Unknown
Size
1 KB
Referenced Files
None
Subscribers
None

D61388.1794420879.diff
View Options

diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c
--- a/sys/kern/link_elf.c
+++ b/sys/kern/link_elf.c
@@ -532,6 +532,27 @@
SYSINIT(link_elf, SI_SUB_KLD, SI_ORDER_THIRD, link_elf_init, NULL);
+static int
+link_elf_check_symtab(const char *filename, const Elf_Sym *symtab,
+ long symcnt, const char *strtab, long strcnt)
+{
+ long i;
+
+ if (symcnt == 0)
+ return (0);
+ if (strcnt <= 0 || strtab[strcnt - 1] != '\0') {
+ link_elf_error(filename, "corrupt symbol string table");
+ return (ENOEXEC);
+ }
+ for (i = 0; i < symcnt; i++) {
+ if (symtab[i].st_name >= strcnt) {
+ link_elf_error(filename, "corrupt symbol name offset");
+ return (ENOEXEC);
+ }
+ }
+ return (0);
+}
+
static int
link_elf_preload_parse_symbols(elf_file_t ef)
{
@@ -577,6 +598,10 @@
return (EINVAL);
}
+ if (link_elf_check_symtab(ef->lf.filename, symtab,
+ symcnt / sizeof(Elf_Sym), strtab, strcnt) != 0)
+ return (EINVAL);
+
ef->ddbsymtab = symtab;
ef->ddbsymcnt = symcnt / sizeof(Elf_Sym);
ef->ddbstrtab = strtab;
@@ -715,6 +740,10 @@
ef->pltrelsize = 0;
}
+ if (ef->lf.size != 0 && link_elf_check_symtab(ef->lf.filename,
+ ef->symtab, ef->nchains, ef->strtab, ef->strsz) != 0)
+ return (ENOEXEC);
+
ef->ddbsymtab = ef->symtab;
ef->ddbsymcnt = ef->nchains;
ef->ddbstrtab = ef->strtab;
@@ -1399,6 +1428,11 @@
if (error != 0)
goto out;
+ error = link_elf_check_symtab(filename, (const Elf_Sym *)ef->symbase,
+ symcnt / sizeof(Elf_Sym), ef->strbase, strcnt);
+ if (error != 0)
+ goto out;
+
ef->ddbsymcnt = symcnt / sizeof(Elf_Sym);
ef->ddbsymtab = (const Elf_Sym *)ef->symbase;
ef->ddbstrcnt = strcnt;

File Metadata

Mime Type
text/plain
Expires
Wed, Nov 11, 6:14 PM (3 h, 5 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41659935
Default Alt Text
D61388.1794420879.diff (1 KB)

Event Timeline