jory/upx
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

invert_pt_dynamic() more checking

Browse Source 
https://github.com/upx/upx/issues/378
https://github.com/upx/upx/issues/379
	modified:   p_lx_elf.cpp
This commit is contained in:
John Reiser
2020-05-23 10:51:03 -07:00
parent da37435384
commit 3d87b34754
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/p_lx_elf.cpp
+12
View File
@@ -1687,6 +1687,12 @@ PackLinuxElf32::invert_pt_dynamic(Elf32_Dyn const *dynp)
unsigned const *const bitmask = (unsigned const *)(void const *)&gashtab[4]; unsigned const *const bitmask = (unsigned const *)(void const *)&gashtab[4];
unsigned const *const buckets = (unsigned const *)&bitmask[n_bitmask]; unsigned const *const buckets = (unsigned const *)&bitmask[n_bitmask];
unsigned const *const hasharr = &buckets[n_bucket]; (void)hasharr; unsigned const *const hasharr = &buckets[n_bucket]; (void)hasharr;
if (!n_bucket || (1u<<31) <= n_bucket /* fie on fuzzers */
|| (void const *)&file_image[file_size] <= (void const *)hasharr) {
char msg[80]; snprintf(msg, sizeof(msg),
"bad n_bucket %#x\n", n_bucket);
throwCantPack(msg);
}
//unsigned const *const gashend = &hasharr[n_bucket]; // minimum, except: //unsigned const *const gashend = &hasharr[n_bucket]; // minimum, except:
// Rust and Android trim unused zeroes from high end of hasharr[] // Rust and Android trim unused zeroes from high end of hasharr[]
unsigned bmax = 0; unsigned bmax = 0;
@@ -5238,6 +5244,12 @@ PackLinuxElf64::invert_pt_dynamic(Elf64_Dyn const *dynp)
upx_uint64_t const *const bitmask = (upx_uint64_t const *)(void const *)&gashtab[4]; upx_uint64_t const *const bitmask = (upx_uint64_t const *)(void const *)&gashtab[4];
unsigned const *const buckets = (unsigned const *)&bitmask[n_bitmask]; unsigned const *const buckets = (unsigned const *)&bitmask[n_bitmask];
unsigned const *const hasharr = &buckets[n_bucket]; (void)hasharr; unsigned const *const hasharr = &buckets[n_bucket]; (void)hasharr;
if (!n_bucket || (1u<<31) <= n_bucket /* fie on fuzzers */
|| (void const *)&file_image[file_size] <= (void const *)hasharr) {
char msg[80]; snprintf(msg, sizeof(msg),
"bad n_bucket %#x\n", n_bucket);
throwCantPack(msg);
}
//unsigned const *const gashend = &hasharr[n_bucket]; // minimum, except: //unsigned const *const gashend = &hasharr[n_bucket]; // minimum, except:
// Rust and Android trim unused zeroes from high end of hasharr[] // Rust and Android trim unused zeroes from high end of hasharr[]
unsigned bmax = 0; unsigned bmax = 0;