diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2025-10-15 20:14:36 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2025-10-15 20:14:36 +0000 |
| commit | c86af2cc4cd12fb0174843b22d737c3b5b5d55d0 (patch) | |
| tree | b44279249dc0f14efefdc56300db6df8c0d735ca | |
| parent | 8596810d02a1e361e0312d116339aa106aca4b19 (diff) | |
imgact_elf: Check note body sizes
In parse_notes we validate that the note name fits within the note
buffer, but we do not do the same for the note data, so there is some
potential for an OOB read in the note handler. Add a bounds check.
Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Reviewed by: kib, emaste
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D53063
| -rw-r--r-- | sys/kern/imgact_elf.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index c53707a1286c..a1fabbc86f27 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -2831,7 +2831,7 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote, } if ((const char *)note_end - (const char *)note < sizeof(Elf_Note)) { - uprintf("ELF note to short\n"); + uprintf("ELF note too short\n"); goto retf; } if (note->n_namesz != checknote->n_namesz || @@ -2839,9 +2839,9 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote, note->n_type != checknote->n_type) goto nextnote; note_name = (const char *)(note + 1); - if (note_name + checknote->n_namesz >= - (const char *)note_end || strncmp(note_vendor, - note_name, checknote->n_namesz) != 0) + if (note_name + roundup2(note->n_namesz, ELF_NOTE_ROUNDSIZE) + + note->n_descsz >= (const char *)note_end || + strncmp(note_vendor, note_name, checknote->n_namesz) != 0) goto nextnote; if (cb(note, cb_arg, &res)) |