mirror of
https://git.yoctoproject.org/poky
synced 2026-02-26 03:19:41 +01:00
268614c13d
Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=480b6fa3662ba8ffeee274bf0d37423413c01e55 Reference https://nvd.nist.gov/vuln/detail/CVE-2021-33294 https://sourceware.org/bugzilla/show_bug.cgi?id=27501 (From OE-Core rev: 9cd6fea32edf8e4da0c33547e1df6d1ec81b350d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
73 lines
2.2 KiB
Diff
73 lines
2.2 KiB
Diff
From 480b6fa3662ba8ffeee274bf0d37423413c01e55 Mon Sep 17 00:00:00 2001
|
|
From: Mark Wielaard <mark@klomp.org>
|
|
Date: Wed, 3 Mar 2021 21:40:53 +0100
|
|
Subject: [PATCH] readelf: Sanity check verneed and verdef offsets in handle_symtab.
|
|
|
|
We are going through vna_next, vn_next and vd_next in a while loop.
|
|
Make sure that all offsets are sane. We don't want things to wrap
|
|
around so we go in cycles.
|
|
|
|
https://sourceware.org/bugzilla/show_bug.cgi?id=27501
|
|
|
|
Signed-off-by: Mark Wielaard <mark@klomp.org>
|
|
|
|
Upstream-Status: Backport [https://sourceware.org/git/?p=elfutils.git;a=commit;h=480b6fa3662ba8ffeee274bf0d37423413c01e55]
|
|
CVE: CVE-2021-33294
|
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
|
---
|
|
src/ChangeLog | 5 +++++
|
|
src/readelf.c | 10 +++++++++-
|
|
2 files changed, 14 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/ChangeLog b/src/ChangeLog
|
|
index 6af977e..f0d9e39 100644
|
|
--- a/src/ChangeLog
|
|
+++ b/src/ChangeLog
|
|
@@ -1,3 +1,8 @@
|
|
+2021-03-03 Mark Wielaard <mark@klomp.org>
|
|
+
|
|
+ * readelf.c (handle_symtab): Sanity check verneed vna_next,
|
|
+ vn_next and verdef vd_next offsets.
|
|
+
|
|
2019-11-26 Mark Wielaard <mark@klomp.org>
|
|
|
|
* Makefile.am (BUILD_STATIC): Add libraries needed for libdw.
|
|
diff --git a/src/readelf.c b/src/readelf.c
|
|
index 5994615..ab7a1c1 100644
|
|
--- a/src/readelf.c
|
|
+++ b/src/readelf.c
|
|
@@ -2550,7 +2550,9 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
|
|
&vernaux_mem);
|
|
while (vernaux != NULL
|
|
&& vernaux->vna_other != *versym
|
|
- && vernaux->vna_next != 0)
|
|
+ && vernaux->vna_next != 0
|
|
+ && (verneed_data->d_size - vna_offset
|
|
+ >= vernaux->vna_next))
|
|
{
|
|
/* Update the offset. */
|
|
vna_offset += vernaux->vna_next;
|
|
@@ -2567,6 +2569,9 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
|
|
/* Found it. */
|
|
break;
|
|
|
|
+ if (verneed_data->d_size - vn_offset < verneed->vn_next)
|
|
+ break;
|
|
+
|
|
vn_offset += verneed->vn_next;
|
|
verneed = (verneed->vn_next == 0
|
|
? NULL
|
|
@@ -2602,6 +2607,9 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr)
|
|
/* Found the definition. */
|
|
break;
|
|
|
|
+ if (verdef_data->d_size - vd_offset < verdef->vd_next)
|
|
+ break;
|
|
+
|
|
vd_offset += verdef->vd_next;
|
|
verdef = (verdef->vd_next == 0
|
|
? NULL
|
|
--
|
|
2.25.1
|
|
|