Changeset 7aa0530 in rtems


Ignore:
Timestamp:
Feb 18, 2019, 1:37:05 AM (10 months ago)
Author:
Chris Johns <chrisj@…>
Branches:
master
Children:
c5615ddc
Parents:
62b01ab
git-author:
Chris Johns <chrisj@…> (02/18/19 01:37:05)
git-committer:
Chris Johns <chrisj@…> (02/19/19 22:08:38)
Message:

libdl/archive: Check for an overflow of the symbol table.

Coverty 1442636

Updates #3686

File:
1 edited

Legend:

Unmodified
Added
Removed
  • cpukit/libdl/rtl-archive.c

    r62b01ab r7aa0530  
    679679
    680680      /*
    681        * The first 4 byte value is the number of entries.
     681       * The first 4 byte value is the number of entries. Range check the
     682       * value so the alloc size does not overflow (Coverity 1442636).
    682683       */
    683684      archive->symbols.entries =
    684685        rtems_rtl_archive_read_32 (archive->symbols.base);
     686      if (archive->symbols.entries >= (SIZE_MAX / sizeof (rtems_rtl_archive_symbol)))
     687      {
     688        rtems_rtl_alloc_del (RTEMS_RTL_ALLOC_SYMBOL, archive->symbols.base);
     689        close (fd);
     690        memset (&archive->symbols, 0, sizeof (archive->symbols));
     691        rtems_rtl_archive_set_error (errno, "too many symbols");
     692        return true;
     693      }
     694
    685695      archive->symbols.size   = size;
    686696      archive->symbols.names  = archive->symbols.base;
     
    692702      if (archive->symbols.entries > RTEMS_RTL_ARCHIVE_SYMBOLS_SORT)
    693703      {
    694         const size_t size =
    695           archive->symbols.entries * sizeof (rtems_rtl_archive_symbol);
     704        size = archive->symbols.entries * sizeof (rtems_rtl_archive_symbol);
    696705        archive->symbols.symbols =
    697706          rtems_rtl_alloc_new (RTEMS_RTL_ALLOC_SYMBOL, size, true);
Note: See TracChangeset for help on using the changeset viewer.