imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

ldd: guard against stack overflow reading corrupted files.

Browse Source 
Reviewed by:	imp, emaste
Reported by:	UK National Cyber Security Centre (NCSC)
Sponsored by:	Juniper Networks, Inc.
Differential Revision:	https://reviews.freebsd.org/D37010
This commit is contained in:
Simon J. Gerraty committed 2022-10-19 14:08:43 -07:00
1 parent 48128454f0
commit b541e44b7c
1 file changed
+8
Download Patch File Download Diff File Expand all files Collapse all files
usr.bin/ldd/ldd.c
+8
View File
@@ -335,6 +335,10 @@ is_executable(const char *fname, int fd, int *is_shlib, int *type)
warnx("%s: header too short", fname);
return (0);
}
if (hdr.elf32.e_phentsize != sizeof(phdr32)) {
warnx("%s: corrupt header", fname);
return (0);
}
for (i = 0; i < hdr.elf32.e_phnum; i++) {
if (read(fd, &phdr32, hdr.elf32.e_phentsize) !=
sizeof(phdr32)) {
@@ -403,6 +407,10 @@ is_executable(const char *fname, int fd, int *is_shlib, int *type)
warnx("%s: header too short", fname);
return (0);
}
if (hdr.elf.e_phentsize != sizeof(phdr)) {
warnx("%s: corrupt header", fname);
return (0);
}
for (i = 0; i < hdr.elf.e_phnum; i++) {
if (read(fd, &phdr, hdr.elf.e_phentsize)
!= sizeof(phdr)) {