Guard check in module loader against integer overflow
authorDavid Howells <dhowells@redhat.com>
Tue, 22 May 2012 14:56:13 +0000 (15:56 +0100)
committerRusty Russell <rusty@rustcorp.com.au>
Wed, 23 May 2012 12:58:53 +0000 (22:28 +0930)
The check:

if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr))

may not work if there's an overflow in the right-hand side of the condition.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
kernel/module.c

index a4e60973ca735847e6121162234dd881f5563241..4edbd9c11aca35a71e56bc237ef638d596a7db23 100644 (file)
@@ -2429,7 +2429,8 @@ static int copy_and_check(struct load_info *info,
                goto free_hdr;
        }
 
-       if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr)) {
+       if (hdr->e_shoff >= len ||
+           hdr->e_shnum * sizeof(Elf_Shdr) > len - hdr->e_shoff) {
                err = -ENOEXEC;
                goto free_hdr;
        }