projects
/
GitHub
/
LineageOS
/
android_kernel_samsung_universal7580.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
3c7ec94
)
Guard check in module loader against integer overflow
author
David Howells
<dhowells@redhat.com>
Tue, 22 May 2012 14:56:13 +0000
(15:56 +0100)
committer
Rusty Russell
<rusty@rustcorp.com.au>
Wed, 23 May 2012 12:58:53 +0000
(22:28 +0930)
The check:
if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr))
may not work if there's an overflow in the right-hand side of the condition.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
kernel/module.c
patch
|
blob
|
blame
|
history
diff --git
a/kernel/module.c
b/kernel/module.c
index a4e60973ca735847e6121162234dd881f5563241..4edbd9c11aca35a71e56bc237ef638d596a7db23 100644
(file)
--- a/
kernel/module.c
+++ b/
kernel/module.c
@@
-2429,7
+2429,8
@@
static int copy_and_check(struct load_info *info,
goto free_hdr;
}
- if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr)) {
+ if (hdr->e_shoff >= len ||
+ hdr->e_shnum * sizeof(Elf_Shdr) > len - hdr->e_shoff) {
err = -ENOEXEC;
goto free_hdr;
}