• Kir Kolyshkin's avatar
    compel handle_elf(): fix strings sect bounds check · b8474f29
    Kir Kolyshkin authored
    Got this when using compel hgen on arm 32-bit:
    
    Error (compel/src/lib/handle-elf-host.c:115): String section header
    @0xf66e11ec is out of [0xf66e1174, 0xf66e1264)
    
    Looking at this, it does not make sense. For the reference,
    sizeof(Elf_Shdr) is 0x28, so end position is also well within bounds.
    
    Apparently, the check for string section header bounds is wrong
    as the last argument of __ptr_struct_oob() is supposed to be a
    region size, not the region end address as it is.
    
    This always worked before because the check was too relaxed, and
    compel was never used on 32-bit ARM. This time it didn't work
    because of a 32-bit overflow, which helped to find this bug.
    
    This is a fix to commit 6402f03 ("compel: separate get_strings_section
    from __handle_elf").
    
    Cc: Dmitry Safonov <dsafonov@virtuozzo.com>
    Signed-off-by: 's avatarKir Kolyshkin <kir@openvz.org>
    Acked-by: 's avatarCyrill Gorcunov <gorcunov@openvz.org>
    Signed-off-by: 's avatarPavel Emelyanov <xemul@virtuozzo.com>
    Signed-off-by: 's avatarAndrei Vagin <avagin@virtuozzo.com>
    b8474f29
handle-elf.c 17.3 KB