Skip to content

Commit

Permalink
libkmod: check for trailing \0 in __ksymtab_strings
Browse files Browse the repository at this point in the history
As per the documentation (man 5 elf) the section must be null
terminated. Move the check further up and remove the no longer needed
code trying to workaround non-compliant instances.

Note: drop the erroneous +1 in the overflow (malloc size) calculation

Signed-off-by: Emil Velikov <[email protected]>
Reviewed-by: Tobias Stoeckmann <[email protected]>
Link: #210
Signed-off-by: Lucas De Marchi <[email protected]>
  • Loading branch information
evelikov authored and lucasdemarchi committed Nov 15, 2024
1 parent 069d314 commit e5ef157
Showing 1 changed file with 8 additions and 15 deletions.
23 changes: 8 additions & 15 deletions libkmod/libkmod-elf.c
Original file line number Diff line number Diff line change
Expand Up @@ -647,7 +647,7 @@ static int kmod_elf_get_symbols_symtab(const struct kmod_elf *elf,
char *itr;
struct kmod_modversion *a;
int count, err;
size_t vec_size, tmp_size, total_size;
size_t vec_size, total_size;

*array = NULL;

Expand All @@ -664,6 +664,11 @@ static int kmod_elf_get_symbols_symtab(const struct kmod_elf *elf,
if (size <= 1)
return 0;

if (strings[size - 1] != '\0') {
ELFDBG(elf, "section __ksymtab_strings does not end with \\0 byte");
return -EINVAL;
}

last = 0;
for (i = 0, count = 0; i < size; i++) {
if (strings[i] == '\0') {
Expand All @@ -675,13 +680,10 @@ static int kmod_elf_get_symbols_symtab(const struct kmod_elf *elf,
last = i + 1;
}
}
if (strings[i - 1] != '\0')
count++;

/* sizeof(struct kmod_modversion) * count + size + 1 */
/* sizeof(struct kmod_modversion) * count + size */
if (umulsz_overflow(sizeof(struct kmod_modversion), count, &vec_size) ||
uaddsz_overflow(size, vec_size, &tmp_size) ||
uaddsz_overflow(1, tmp_size, &total_size)) {
uaddsz_overflow(size, vec_size, &total_size)) {
return -ENOMEM;
}

Expand All @@ -708,15 +710,6 @@ static int kmod_elf_get_symbols_symtab(const struct kmod_elf *elf,
last = i + 1;
}
}
if (strings[i - 1] != '\0') {
size_t slen = i - last;
a[count].crc = 0;
a[count].bind = KMOD_SYMBOL_GLOBAL;
a[count].symbol = itr;
memcpy(itr, strings + last, slen);
itr[slen] = '\0';
count++;
}

return count;
}
Expand Down

0 comments on commit e5ef157

Please sign in to comment.