From nobody Sat Apr 27 16:16:14 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1486249604067114.95470671726014; Sat, 4 Feb 2017 15:06:44 -0800 (PST) Received: from localhost ([::1]:41121 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ca9Pl-0003QX-7x for importer@patchew.org; Sat, 04 Feb 2017 18:06:41 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37112) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ca9Os-00038i-SS for qemu-devel@nongnu.org; Sat, 04 Feb 2017 18:05:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ca9Op-0006lJ-P8 for qemu-devel@nongnu.org; Sat, 04 Feb 2017 18:05:46 -0500 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:48409) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1ca9Op-0006gR-Ha for qemu-devel@nongnu.org; Sat, 04 Feb 2017 18:05:43 -0500 Received: from mnementh.archaic.org.uk ([81.2.115.146]) by orth.archaic.org.uk with esmtp (Exim 4.84_2) (envelope-from ) id 1ca9Og-0003Ui-LM; Sat, 04 Feb 2017 23:05:34 +0000 Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.84_2) (envelope-from ) id 1ca9Of-0001NR-S5; Sat, 04 Feb 2017 23:05:33 +0000 From: Peter Maydell To: qemu-devel@nongnu.org Date: Sat, 4 Feb 2017 23:05:33 +0000 Message-Id: <1486249533-5260-1-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 2.1.4 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PATCH] linux-user: Use correct types in load_symbols() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Riku Voipio , Laurent Vivier , patches@linaro.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Coverity doesn't like the code in load_symbols() which assumes it can use 'int' for a variable that might hold an offset into the guest ELF file, because in a 64-bit guest that could overflow. Guest binaries with 2GB sections aren't very likely and this isn't a security issue because we fully trust the guest linux-user binary anyway, but we might as well use the right types, which will placate Coverity. Use uint64_t to hold section sizes, and bail out if the symbol table is too large rather than just overflowing an int. (Coverity issue CID1005776) Signed-off-by: Peter Maydell Reviewed-by: Laurent Vivier Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- linux-user/elfload.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/linux-user/elfload.c b/linux-user/elfload.c index c66cbbe..f4c7b0c 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -2263,6 +2263,7 @@ static int symcmp(const void *s0, const void *s1) static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias) { int i, shnum, nsyms, sym_idx =3D 0, str_idx =3D 0; + uint64_t segsz; struct elf_shdr *shdr; char *strings =3D NULL; struct syminfo *s =3D NULL; @@ -2294,19 +2295,26 @@ static void load_symbols(struct elfhdr *hdr, int fd= , abi_ulong load_bias) goto give_up; } =20 - i =3D shdr[str_idx].sh_size; - s->disas_strtab =3D strings =3D g_try_malloc(i); - if (!strings || pread(fd, strings, i, shdr[str_idx].sh_offset) !=3D i)= { + segsz =3D shdr[str_idx].sh_size; + s->disas_strtab =3D strings =3D g_try_malloc(segsz); + if (!strings || + pread(fd, strings, segsz, shdr[str_idx].sh_offset) !=3D segsz) { goto give_up; } =20 - i =3D shdr[sym_idx].sh_size; - syms =3D g_try_malloc(i); - if (!syms || pread(fd, syms, i, shdr[sym_idx].sh_offset) !=3D i) { + segsz =3D shdr[sym_idx].sh_size; + syms =3D g_try_malloc(segsz); + if (!syms || pread(fd, syms, segsz, shdr[sym_idx].sh_offset) !=3D segs= z) { goto give_up; } =20 - nsyms =3D i / sizeof(struct elf_sym); + if (segsz / sizeof(struct elf_sym) > INT_MAX) { + /* Implausibly large symbol table: give up rather than ploughing + * on with the number of symbols calculation overflowing + */ + goto give_up; + } + nsyms =3D segsz / sizeof(struct elf_sym); for (i =3D 0; i < nsyms; ) { bswap_sym(syms + i); /* Throw away entries which we do not need. */ --=20 2.1.4