| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172 |
- Subject: Bail out on partial reads, from Alexander Cherepanov
- ID: CVE-2014-9653
- Upstream-Author: Christos Zoulas <christos@zoulas.com>
- Date: Tue Dec 16 20:53:05 2014 +0000
- Origin: FILE5_21-10-g445c8fb
- Last-Update: 2015-04-19
- --- a/src/readelf.c
- +++ b/src/readelf.c
- @@ -324,7 +324,7 @@
- * Loop through all the program headers.
- */
- for ( ; num; num--) {
- - if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
- + if (pread(fd, xph_addr, xph_sizeof, off) < (ssize_t)xph_sizeof) {
- file_badread(ms);
- return -1;
- }
- @@ -852,6 +852,7 @@
- uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilites */
- uint64_t cap_sf1 = 0; /* SunOS 5.x software capabilites */
- char name[50];
- + ssize_t namesize;
-
- if (size != xsh_sizeof) {
- if (file_printf(ms, ", corrupted section header size") == -1)
- @@ -860,7 +861,7 @@
- }
-
- /* Read offset of name section to be able to read section names later */
- - if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) {
- + if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) < (ssize_t)xsh_sizeof) {
- file_badread(ms);
- return -1;
- }
- @@ -868,15 +869,15 @@
-
- for ( ; num; num--) {
- /* Read the name of this section. */
- - if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) {
- + if ((namesize = pread(fd, name, sizeof(name) - 1, name_off + xsh_name)) == -1) {
- file_badread(ms);
- return -1;
- }
- - name[sizeof(name) - 1] = '\0';
- + name[namesize] = '\0';
- if (strcmp(name, ".debug_info") == 0)
- stripped = 0;
-
- - if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) {
- + if (pread(fd, xsh_addr, xsh_sizeof, off) < (ssize_t)xsh_sizeof) {
- file_badread(ms);
- return -1;
- }
- @@ -900,7 +901,7 @@
- " for note");
- return -1;
- }
- - if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) {
- + if (pread(fd, nbuf, xsh_size, xsh_offset) < (ssize_t)xsh_size) {
- file_badread(ms);
- free(nbuf);
- return -1;
- @@ -1056,7 +1057,7 @@
- }
-
- for ( ; num; num--) {
- - if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
- + if (pread(fd, xph_addr, xph_sizeof, off) < (ssize_t)xph_sizeof) {
- file_badread(ms);
- return -1;
- }
|
