From 3d87b34754bbac3e171600be396ec652794b2cfa Mon Sep 17 00:00:00 2001 From: John Reiser Date: Sat, 23 May 2020 10:51:03 -0700 Subject: [PATCH] invert_pt_dynamic() more checking https://github.com/upx/upx/issues/378 https://github.com/upx/upx/issues/379 modified: p_lx_elf.cpp --- src/p_lx_elf.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp index bee683d7..c9778362 100644 --- a/src/p_lx_elf.cpp +++ b/src/p_lx_elf.cpp @@ -1687,6 +1687,12 @@ PackLinuxElf32::invert_pt_dynamic(Elf32_Dyn const *dynp) unsigned const *const bitmask = (unsigned const *)(void const *)&gashtab[4]; unsigned const *const buckets = (unsigned const *)&bitmask[n_bitmask]; unsigned const *const hasharr = &buckets[n_bucket]; (void)hasharr; + if (!n_bucket || (1u<<31) <= n_bucket /* fie on fuzzers */ + || (void const *)&file_image[file_size] <= (void const *)hasharr) { + char msg[80]; snprintf(msg, sizeof(msg), + "bad n_bucket %#x\n", n_bucket); + throwCantPack(msg); + } //unsigned const *const gashend = &hasharr[n_bucket]; // minimum, except: // Rust and Android trim unused zeroes from high end of hasharr[] unsigned bmax = 0; @@ -5238,6 +5244,12 @@ PackLinuxElf64::invert_pt_dynamic(Elf64_Dyn const *dynp) upx_uint64_t const *const bitmask = (upx_uint64_t const *)(void const *)&gashtab[4]; unsigned const *const buckets = (unsigned const *)&bitmask[n_bitmask]; unsigned const *const hasharr = &buckets[n_bucket]; (void)hasharr; + if (!n_bucket || (1u<<31) <= n_bucket /* fie on fuzzers */ + || (void const *)&file_image[file_size] <= (void const *)hasharr) { + char msg[80]; snprintf(msg, sizeof(msg), + "bad n_bucket %#x\n", n_bucket); + throwCantPack(msg); + } //unsigned const *const gashend = &hasharr[n_bucket]; // minimum, except: // Rust and Android trim unused zeroes from high end of hasharr[] unsigned bmax = 0;