From 2caac530f13bf69a988f65eb109f26a7311936c6 Mon Sep 17 00:00:00 2001 From: Steve Grubb Date: Thu, 20 Feb 2020 17:58:55 -0500 Subject: [PATCH] Sanity check e_phentsize in ELF parser --- src/file.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/file.c b/src/file.c index 3c9d084..e0d4f85 100644 --- a/src/file.c +++ b/src/file.c @@ -469,6 +469,12 @@ uint32_t gather_elf(int fd, off_t size) // We want to do a basic size check to make sure unsigned long sz = (unsigned)hdr->e_phentsize * (unsigned)hdr->e_phnum; + /* Verify the entry size is right */ + if ((unsigned)hdr->e_phentsize != sizeof(Elf32_Phdr)) { + info |= HAS_ERROR; + free(hdr); + goto rewind_out; + } if (sz > ((unsigned long)size - sizeof(Elf32_Ehdr))) { info |= HAS_ERROR; free(hdr); @@ -600,6 +606,12 @@ uint32_t gather_elf(int fd, off_t size) // We want to do a basic size check to make sure unsigned long sz = (unsigned)hdr->e_phentsize * (unsigned)hdr->e_phnum; + /* Verify the entry size is right */ + if ((unsigned)hdr->e_phentsize != sizeof(Elf64_Phdr)) { + info |= HAS_ERROR; + free(hdr); + goto rewind_out; + } if (sz > ((unsigned long)size - sizeof(Elf64_Ehdr))) { info |= HAS_ERROR; free(hdr);