svn commit: r282144 - head/usr.sbin/crunch/crunchide

[Ed Maste]

Author: emaste
Date: Tue Apr 28 13:04:51 2015
New Revision: 282144
URL: https://svnweb.freebsd.org/changeset/base/282144

Log:
  crunchide: add basic string table sanity checks
  
  Reported by:	Coverity Scan
  CID:		978805, 980919
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/usr.sbin/crunch/crunchide/exec_elf32.c

Modified: head/usr.sbin/crunch/crunchide/exec_elf32.c
==============================================================================
--- head/usr.sbin/crunch/crunchide/exec_elf32.c	Tue Apr 28 12:52:08 2015	(r282143)
+++ head/usr.sbin/crunch/crunchide/exec_elf32.c	Tue Apr 28 13:04:51 2015	(r282144)
@@ -321,11 +321,14 @@ ELFNAMEEND(hide)(int fd, const char *fn)
 	 */
 
 	/* load section string table for debug use */
-	if ((shstrtabp = xmalloc(xewtoh(shstrtabshdr->sh_size), fn,
-	    "section string table")) == NULL)
+	if ((size = xewtoh(shstrtabshdr->sh_size)) == 0)
+		goto bad;
+	if ((shstrtabp = xmalloc(size, fn, "section string table")) == NULL)
 		goto bad;
 	if ((size_t)xreadatoff(fd, shstrtabp, xewtoh(shstrtabshdr->sh_offset),
-	    xewtoh(shstrtabshdr->sh_size), fn) != xewtoh(shstrtabshdr->sh_size))
+	    size, fn) != size)
+		goto bad;
+	if (shstrtabp[size - 1] != '\0')
 		goto bad;
 
 	/* we need symtab, strtab, and everything behind strtab */
@@ -346,7 +349,8 @@ ELFNAMEEND(hide)(int fd, const char *fn)
 			strtabidx = i;
 		if (layoutp[i].shdr == symtabshdr || i >= strtabidx) {
 			off = xewtoh(layoutp[i].shdr->sh_offset);
-			size = xewtoh(layoutp[i].shdr->sh_size);
+			if ((size = xewtoh(layoutp[i].shdr->sh_size)) == 0)
+				goto bad;
 			layoutp[i].bufp = xmalloc(size, fn,
 			    shstrtabp + xewtoh(layoutp[i].shdr->sh_name));
 			if (layoutp[i].bufp == NULL)
@@ -356,10 +360,13 @@ ELFNAMEEND(hide)(int fd, const char *fn)
 				goto bad;
 
 			/* set symbol table and string table */
-			if (layoutp[i].shdr == symtabshdr)
+			if (layoutp[i].shdr == symtabshdr) {
 				symtabp = layoutp[i].bufp;
-			else if (layoutp[i].shdr == strtabshdr)
+			} else if (layoutp[i].shdr == strtabshdr) {
 				strtabp = layoutp[i].bufp;
+				if (strtabp[size - 1] != '\0')
+					goto bad;
+			}
 		}
 	}