1 |
commit: 82fc8ce64f61445c52e5c9a4d5ac294b6af7c92d |
2 |
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org> |
3 |
AuthorDate: Tue Jan 24 02:13:03 2017 +0000 |
4 |
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue Jan 24 02:13:03 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/pax-utils.git/commit/?id=82fc8ce6 |
7 |
|
8 |
scanelf: fix offset checking when looking up symbols via hash |
9 |
|
10 |
A number of refactors hid bugs here in that the first offset value |
11 |
here would be left over from earlier code. Localize the code a bit |
12 |
to try and keep that from happening again. |
13 |
|
14 |
We also reload phdr since this loop expects to walk the whole table. |
15 |
|
16 |
scanelf.c | 9 +++++---- |
17 |
1 file changed, 5 insertions(+), 4 deletions(-) |
18 |
|
19 |
diff --git a/scanelf.c b/scanelf.c |
20 |
index 2729d0f..52c436a 100644 |
21 |
--- a/scanelf.c |
22 |
+++ b/scanelf.c |
23 |
@@ -261,7 +261,7 @@ static void scanelf_file_get_symtabs(elfobj *elf, void **sym, void **str) |
24 |
Elf ## B ## _Phdr *phdr; \ |
25 |
Elf ## B ## _Addr vsym, vstr, vhash, vgnu_hash; \ |
26 |
Elf ## B ## _Dyn *dyn; \ |
27 |
- Elf ## B ## _Off offset; \ |
28 |
+ Elf ## B ## _Off doffset; \ |
29 |
\ |
30 |
/* lookup symbols used at runtime with DT_SYMTAB / DT_STRTAB */ \ |
31 |
vsym = vstr = vhash = vgnu_hash = 0; \ |
32 |
@@ -272,9 +272,9 @@ static void scanelf_file_get_symtabs(elfobj *elf, void **sym, void **str) |
33 |
phdr = scanelf_file_get_pt_dynamic(elf); \ |
34 |
if (phdr == NULL) \ |
35 |
break; \ |
36 |
- offset = EGET(phdr->p_offset); \ |
37 |
+ doffset = EGET(phdr->p_offset); \ |
38 |
\ |
39 |
- dyn = DYN ## B (elf->vdata + offset); \ |
40 |
+ dyn = DYN ## B (elf->vdata + doffset); \ |
41 |
while (EGET(dyn->d_tag) != DT_NULL) { \ |
42 |
switch (EGET(dyn->d_tag)) { \ |
43 |
case DT_SYMTAB: vsym = EGET(dyn->d_un.d_val); break; \ |
44 |
@@ -290,15 +290,16 @@ static void scanelf_file_get_symtabs(elfobj *elf, void **sym, void **str) |
45 |
return; \ |
46 |
\ |
47 |
/* calc offset into the ELF by finding the load addr of the syms */ \ |
48 |
+ phdr = PHDR ## B (elf->phdr); \ |
49 |
for (i = 0; i < EGET(ehdr->e_phnum); i++) { \ |
50 |
Elf ## B ## _Addr vaddr = EGET(phdr[i].p_vaddr); \ |
51 |
Elf ## B ## _Addr filesz = EGET(phdr[i].p_filesz); \ |
52 |
+ Elf ## B ## _Off offset = EGET(phdr[i].p_offset); \ |
53 |
Elf ## B ## _Off hash_offset = offset + (vhash - vaddr); \ |
54 |
\ |
55 |
if (EGET(phdr[i].p_type) != PT_LOAD) \ |
56 |
continue; \ |
57 |
\ |
58 |
- offset = EGET(phdr[i].p_offset); \ |
59 |
if (offset >= (uint64_t)elf->len) \ |
60 |
goto corrupt_hash; \ |
61 |
if (filesz >= (uint64_t)elf->len) \ |