mirror/upx
1
0
Fork 0
mirror of https://github.com/upx/upx synced 2025-10-05 19:20:23 +08:00
Code Issues Releases Wiki Activity

More checking of DT_HASH and DT_GNU_HASH

Browse Source 
https://github.com/upx/upx/issues/235  POC12
	modified:   p_lx_elf.cpp
This commit is contained in:
John Reiser 2018-12-15 20:43:33 -08:00
parent 7c766b3313
commit b8f6be5389
1 changed files with 26 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
src/p_lx_elf.cpp
View File

@ -1607,11 +1607,12 @@ PackLinuxElf32::invert_pt_dynamic(Elf32_Dyn const *dynp)
unsigned const *const chains = &buckets[nbucket]; unsigned const *const chains = &buckets[nbucket];
unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val); unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val);
if (v_hsh < v_sym if (!nbucket
&& (v_sym - v_hsh) < (sizeof(unsigned)*2 // headers || ((v_hsh < v_sym) && (v_sym - v_hsh) < (sizeof(unsigned)*2 // headers
+ sizeof(*buckets)*nbucket // buckets + sizeof(*buckets)*nbucket // buckets
+ sizeof(*chains) *nbucket // chains + sizeof(*chains) *nbucket // chains
)) { ))
) {
char msg[90]; snprintf(msg, sizeof(msg), char msg[90]; snprintf(msg, sizeof(msg),
"bad DT_HASH nbucket=%#x len=%#x", "bad DT_HASH nbucket=%#x len=%#x",
nbucket, (v_sym - v_hsh)); nbucket, (v_sym - v_hsh));
@ -1630,12 +1631,13 @@ PackLinuxElf32::invert_pt_dynamic(Elf32_Dyn const *dynp)
//unsigned const *const gashend = &hasharr[n_bucket]; // minimum //unsigned const *const gashend = &hasharr[n_bucket]; // minimum
unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val); unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val);
if (v_gsh < v_sym if (!n_bucket || !n_bitmask
&& (v_sym - v_gsh) < (sizeof(unsigned)*4 // headers || ((v_gsh < v_sym) && (v_sym - v_gsh) < (sizeof(unsigned)*4 // headers
+ sizeof(*bitmask)*n_bitmask // bitmask + sizeof(*bitmask)*n_bitmask // bitmask
+ sizeof(*buckets)*n_bucket // buckets + sizeof(*buckets)*n_bucket // buckets
+ sizeof(*hasharr)*n_bucket // hasharr + sizeof(*hasharr)*n_bucket // hasharr
)) { ))
) {
char msg[90]; snprintf(msg, sizeof(msg), char msg[90]; snprintf(msg, sizeof(msg),
"bad DT_GNU_HASH n_bucket=%#x n_bitmask=%#x len=%#x", "bad DT_GNU_HASH n_bucket=%#x n_bitmask=%#x len=%#x",
n_bucket, n_bitmask, v_sym - v_gsh); n_bucket, n_bitmask, v_sym - v_gsh);
@ -4782,11 +4784,12 @@ PackLinuxElf64::invert_pt_dynamic(Elf64_Dyn const *dynp)
unsigned const *const chains = &buckets[nbucket]; unsigned const *const chains = &buckets[nbucket];
unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val); unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val);
if (v_hsh < v_sym if (!nbucket
&& (v_sym - v_hsh) < (sizeof(unsigned)*2 // headers || ((v_hsh < v_sym) && (v_sym - v_hsh) < (sizeof(unsigned)*2 // headers
+ sizeof(*buckets)*nbucket // buckets + sizeof(*buckets)*nbucket // buckets
+ sizeof(*chains) *nbucket // chains + sizeof(*chains) *nbucket // chains
)) { ))
) {
char msg[90]; snprintf(msg, sizeof(msg), char msg[90]; snprintf(msg, sizeof(msg),
"bad DT_HASH nbucket=%#x len=%#x", "bad DT_HASH nbucket=%#x len=%#x",
nbucket, (v_sym - v_hsh)); nbucket, (v_sym - v_hsh));
@ -4805,12 +4808,13 @@ PackLinuxElf64::invert_pt_dynamic(Elf64_Dyn const *dynp)
//unsigned const *const gashend = &hasharr[n_bucket]; // minimum //unsigned const *const gashend = &hasharr[n_bucket]; // minimum
upx_uint64_t const v_sym = get_te64(&dynp0[-1+ x_sym].d_val); upx_uint64_t const v_sym = get_te64(&dynp0[-1+ x_sym].d_val);
if (v_gsh < v_sym if (!n_bucket || !n_bitmask
&& (v_sym - v_gsh) < (sizeof(unsigned)*4 // headers || ((v_gsh < v_sym) && (v_sym - v_gsh) < (sizeof(unsigned)*4 // headers
+ sizeof(*bitmask)*n_bitmask // bitmask + sizeof(*bitmask)*n_bitmask // bitmask
+ sizeof(*buckets)*n_bucket // buckets + sizeof(*buckets)*n_bucket // buckets
+ sizeof(*hasharr)*n_bucket // hasharr + sizeof(*hasharr)*n_bucket // hasharr
)) { ))
) {
char msg[90]; snprintf(msg, sizeof(msg), char msg[90]; snprintf(msg, sizeof(msg),
"bad DT_GNU_HASH n_bucket=%#x n_bitmask=%#x len=%#lx", "bad DT_GNU_HASH n_bucket=%#x n_bitmask=%#x len=%#lx",
n_bucket, n_bitmask, (long unsigned)(v_sym - v_gsh)); n_bucket, n_bitmask, (long unsigned)(v_sym - v_gsh));