From c0821ba39ec67b5066763bb3a64c9461eb4e59f5 Mon Sep 17 00:00:00 2001 From: emaste Date: Thu, 21 May 2015 19:16:28 +0000 Subject: [PATCH] MFC r282144: crunchide: add basic string table sanity checks Reported by: Coverity Scan CID: 978805, 980919 Sponsored by: The FreeBSD Foundation git-svn-id: svn://svn.freebsd.org/base/stable/10@283260 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- usr.sbin/crunch/crunchide/exec_elf32.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/usr.sbin/crunch/crunchide/exec_elf32.c b/usr.sbin/crunch/crunchide/exec_elf32.c index 8813497a7..288edf690 100644 --- a/usr.sbin/crunch/crunchide/exec_elf32.c +++ b/usr.sbin/crunch/crunchide/exec_elf32.c @@ -342,11 +342,14 @@ ELFNAMEEND(hide)(int fd, const char *fn) */ /* load section string table for debug use */ - if ((shstrtabp = xmalloc(xewtoh(shstrtabshdr->sh_size), fn, - "section string table")) == NULL) + if ((size = xewtoh(shstrtabshdr->sh_size)) == 0) + goto bad; + if ((shstrtabp = xmalloc(size, fn, "section string table")) == NULL) goto bad; if ((size_t)xreadatoff(fd, shstrtabp, xewtoh(shstrtabshdr->sh_offset), - xewtoh(shstrtabshdr->sh_size), fn) != xewtoh(shstrtabshdr->sh_size)) + size, fn) != size) + goto bad; + if (shstrtabp[size - 1] != '\0') goto bad; /* we need symtab, strtab, and everything behind strtab */ @@ -367,7 +370,8 @@ ELFNAMEEND(hide)(int fd, const char *fn) strtabidx = i; if (layoutp[i].shdr == symtabshdr || i >= strtabidx) { off = xewtoh(layoutp[i].shdr->sh_offset); - size = xewtoh(layoutp[i].shdr->sh_size); + if ((size = xewtoh(layoutp[i].shdr->sh_size)) == 0) + goto bad; layoutp[i].bufp = xmalloc(size, fn, shstrtabp + xewtoh(layoutp[i].shdr->sh_name)); if (layoutp[i].bufp == NULL) @@ -377,10 +381,13 @@ ELFNAMEEND(hide)(int fd, const char *fn) goto bad; /* set symbol table and string table */ - if (layoutp[i].shdr == symtabshdr) + if (layoutp[i].shdr == symtabshdr) { symtabp = layoutp[i].bufp; - else if (layoutp[i].shdr == strtabshdr) + } else if (layoutp[i].shdr == strtabshdr) { strtabp = layoutp[i].bufp; + if (strtabp[size - 1] != '\0') + goto bad; + } } } -- 2.45.0