compel: fix sign-extension in get_strings_section
Well, I hope, I will not make integer promotion mistakes anymore:
> 6.3.1.1
> If an int can represent all values of the original type, the value
> is converted to an int; otherwise, it is converted to an unsigned int.
> These are called the integer promotions.48) All other types are
> unchanged by the integer promotions.
>>> CID 161317: (SIGN_EXTENSION)
>>> Suspicious implicit sign extension: "hdr->e_shentsize" with type
"unsigned short" (16 bits, unsigned) is promoted in
"hdr->e_shentsize * hdr->e_shnum" to type "int" (32 bits, signed),
then sign-extended to type "unsigned long" (64 bits, unsigned).
If "hdr->e_shentsize * hdr->e_shnum" is greater than 0x7FFFFFFF,
the upper bits of the result will all be 1.
96 size_t sec_table_size = hdr->e_shentsize * hdr->e_shnum;
>>> CID 161317: (SIGN_EXTENSION)
>>> Suspicious implicit sign extension: "hdr->e_shentsize" with type
"unsigned short" (16 bits, unsigned) is promoted in
"hdr->e_shentsize * hdr->e_shstrndx" to type "int" (32 bits, signed),
then sign-extended to type "unsigned long" (64 bits, unsigned).
If "hdr->e_shentsize * hdr->e_shstrndx" is greater than 0x7FFFFFFF,
the upper bits of the result will all be 1.
111 addr = sec_table + hdr->e_shentsize * hdr->e_shstrndx;
Fixes: #157
Fixes: commit 36664a3cabec ("compel: separate get_strings_section from
__handle_elf").
Reported-by: Coverity
Reported-by:
Andrew Vagin <avagin@virtuozzo.com>
Cc: Andrew Vagin <avagin@virtuozzo.com>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by:
Dmitry Safonov <dsafonov@virtuozzo.com>
Acked-by:
Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by:
Pavel Emelyanov <xemul@virtuozzo.com>
Signed-off-by:
Andrei Vagin <avagin@virtuozzo.com>
Showing
Please
register
or
sign in
to comment