GitHub-Mirror/linux-bl808
2
0
Fork 0
mirror of https://github.com/Fishwaldo/linux-bl808.git synced 2025-06-07 07:05:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Guard check in module loader against integer overflow

Browse source 
The check:

	if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr))

may not work if there's an overflow in the right-hand side of the condition.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
David Howells 2012-05-22 15:56:13 +01:00 • committed by Rusty Russell
parent 3c7ec94d2c
commit ef26a5a6ea
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
kernel/module.c
View file

@ -2429,7 +2429,8 @@ static int copy_and_check(struct load_info *info,
goto free_hdr; goto free_hdr;
} }
if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr)) { if (hdr->e_shoff >= len ||
hdr->e_shnum * sizeof(Elf_Shdr) > len - hdr->e_shoff) {
err = -ENOEXEC; err = -ENOEXEC;
goto free_hdr; goto free_hdr;
} }