• Dmitry Safonov's avatar
    compel: fix sign-extension in get_strings_section · 72cc02d1
    Dmitry Safonov authored
    Well, I hope, I will not make integer promotion mistakes anymore:
    > 6.3.1.1
    >   If an int can represent all values of the original type, the value
    > is converted to an int; otherwise, it is converted to an unsigned int.
    > These are called the integer promotions.48) All other types are
    > unchanged by the integer promotions.
    
    >>> CID 161317:    (SIGN_EXTENSION)
    >>> Suspicious implicit sign extension: "hdr->e_shentsize" with type
        "unsigned short" (16 bits, unsigned) is promoted in
        "hdr->e_shentsize * hdr->e_shnum" to type "int" (32 bits, signed),
        then sign-extended to type "unsigned long" (64 bits, unsigned).
        If "hdr->e_shentsize * hdr->e_shnum" is greater than 0x7FFFFFFF,
        the upper bits of the result will all be 1.
    96      size_t sec_table_size = hdr->e_shentsize * hdr->e_shnum;
    
    >>> CID 161317:    (SIGN_EXTENSION)
    >>> Suspicious implicit sign extension: "hdr->e_shentsize" with type
        "unsigned short" (16 bits, unsigned) is promoted in
        "hdr->e_shentsize * hdr->e_shstrndx" to type "int" (32 bits, signed),
        then sign-extended to type "unsigned long" (64 bits, unsigned).
        If "hdr->e_shentsize * hdr->e_shstrndx" is greater than 0x7FFFFFFF,
        the upper bits of the result will all be 1.
    111             addr = sec_table + hdr->e_shentsize * hdr->e_shstrndx;
    
    Fixes: #157
    Fixes: commit 36664a3cabec ("compel: separate get_strings_section from
    __handle_elf").
    
    Reported-by: Coverity
    Reported-by: 's avatarAndrew Vagin <avagin@virtuozzo.com>
    Cc: Andrew Vagin <avagin@virtuozzo.com>
    Cc: Cyrill Gorcunov <gorcunov@openvz.org>
    Signed-off-by: 's avatarDmitry Safonov <dsafonov@virtuozzo.com>
    Acked-by: 's avatarCyrill Gorcunov <gorcunov@openvz.org>
    Signed-off-by: 's avatarPavel Emelyanov <xemul@virtuozzo.com>
    Signed-off-by: 's avatarAndrei Vagin <avagin@virtuozzo.com>
    72cc02d1
handle-elf.c 16.9 KB