From 012018907ca05eb0ab51d424a596ef38fc87cae1 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Wed, 16 Jan 2019 11:57:35 +0100 Subject: [PATCH] libebl: Check GNU property note pr_datasz fits inside note description. Before printing the data values, make sure pr_datasz doesn't go beyond the end of the note description data. https://sourceware.org/bugzilla/show_bug.cgi?id=24075 Signed-off-by: Mark Wielaard Upstream-Status: Backport CVE: CVE-2019-7146 patch #1 Signed-off-by: Armin Kuster --- libebl/ChangeLog | 4 ++++ libebl/eblobjnote.c | 7 +++++++ 2 files changed, 11 insertions(+) Index: elfutils-0.175/libebl/eblobjnote.c =================================================================== --- elfutils-0.175.orig/libebl/eblobjnote.c +++ elfutils-0.175/libebl/eblobjnote.c @@ -350,6 +350,13 @@ ebl_object_note (Ebl *ebl, uint32_t name desc += 8; descsz -= 8; + if (prop.pr_datasz > descsz) + { + printf ("BAD property datasz: %" PRId32 "\n", + prop.pr_datasz); + return; + } + int elfclass = gelf_getclass (ebl->elf); char *elfident = elf_getident (ebl->elf, NULL); GElf_Ehdr ehdr; Index: elfutils-0.175/libebl/ChangeLog =================================================================== --- elfutils-0.175.orig/libebl/ChangeLog +++ elfutils-0.175/libebl/ChangeLog @@ -1,3 +1,7 @@ +2019-01-16 Mark Wielaard + + * eblobjnte.c (ebl_object_note): Check pr_datasz isn't too large. + 2018-11-15 Mark Wielaard * eblobjnotetypename.c (ebl_object_note_type_name): Don't update