imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

imgact_elf: Check note body sizes

Browse Source 
In parse_notes we validate that the note name fits within the note
buffer, but we do not do the same for the note data, so there is some
potential for an OOB read in the note handler.  Add a bounds check.

Reported by:	Ilja Van Sprundel <[email protected]>
Reviewed by:	kib, emaste
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D53063
This commit is contained in:
Mark Johnston committed 2025-10-15 20:14:36 +00:00
1 parent 8596810d02
commit c86af2cc4c
1 file changed
+4 -4
Download Patch File Download Diff File Expand all files Collapse all files
sys/kern/imgact_elf.c
+4 -4
View File
@@ -2831,7 +2831,7 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote,
}
if ((const char *)note_end - (const char *)note <
sizeof(Elf_Note)) {
uprintf("ELF note to short\n");
uprintf("ELF note too short\n");
goto retf;
}
if (note->n_namesz != checknote->n_namesz ||
@@ -2839,9 +2839,9 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote,
note->n_type != checknote->n_type)
goto nextnote;
note_name = (const char *)(note + 1);
if (note_name + checknote->n_namesz >=
(const char *)note_end || strncmp(note_vendor,
note_name, checknote->n_namesz) != 0)
if (note_name + roundup2(note->n_namesz, ELF_NOTE_ROUNDSIZE) +
note->n_descsz >= (const char *)note_end ||
strncmp(note_vendor, note_name, checknote->n_namesz) != 0)
goto nextnote;
if (cb(note, cb_arg, &res))