KekenoBSD/src
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

imgact_elf: Check note body sizes

Browse Source 
In parse_notes we validate that the note name fits within the note
buffer, but we do not do the same for the note data, so there is some
potential for an OOB read in the note handler.  Add a bounds check.

Reported by:	Ilja Van Sprundel <ivansprundel@ioactive.com>
Reviewed by:	kib, emaste
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D53063
This commit is contained in:
Mark Johnston
2025-10-15 20:14:36 +00:00
parent 8596810d02
commit c86af2cc4c
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/kern/imgact_elf.c
+4 -4
View File
@@ -2831,7 +2831,7 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote,
} }
if ((const char *)note_end - (const char *)note < if ((const char *)note_end - (const char *)note <
sizeof(Elf_Note)) { sizeof(Elf_Note)) {
uprintf("ELF note to short\n"); uprintf("ELF note too short\n");
goto retf; goto retf;
} }
if (note->n_namesz != checknote->n_namesz || if (note->n_namesz != checknote->n_namesz ||
@@ -2839,9 +2839,9 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote,
note->n_type != checknote->n_type) note->n_type != checknote->n_type)
goto nextnote; goto nextnote;
note_name = (const char *)(note + 1); note_name = (const char *)(note + 1);
if (note_name + checknote->n_namesz >= if (note_name + roundup2(note->n_namesz, ELF_NOTE_ROUNDSIZE) +
(const char *)note_end || strncmp(note_vendor, note->n_descsz >= (const char *)note_end ||
note_name, checknote->n_namesz) != 0) strncmp(note_vendor, note_name, checknote->n_namesz) != 0)
goto nextnote; goto nextnote;
if (cb(note, cb_arg, &res)) if (cb(note, cb_arg, &res))