elf: handle some invalid sizes #121
Conversation
| @@ -466,6 +472,7 @@ macro_rules! elf_dyn_std_impl { | |||
| pub fn from_fd(mut fd: &File, phdrs: &[$phdr]) -> Result<Option<Vec<Dyn>>> { | |||
| for phdr in phdrs { | |||
| if phdr.p_type == PT_DYNAMIC { | |||
| // FIXME: validate filesz before allocating | |||
There was a problem hiding this comment.
I don't know how to validate this. Probably we could do fd.take(filesz).read_to_end() (and then check the correct length was read?), but then need to convert that Vec[u8] into a Vec[Dyn].
There was a problem hiding this comment.
I think this method is only used by things that load off disk like a dynamic linker so it shouldn’t be on the parser code path; however yes we should do something here but I wouldn’t worry about it for now
| let size = count * Sym::size_with(&ctx); | ||
| let size = count | ||
| .checked_mul(Sym::size_with(&ctx)) | ||
| .ok_or(::error::Error::Malformed(format!("Too many ELF symbols (offset {:#x}, count {})", |
There was a problem hiding this comment.
Are we 2018 in this crate ? We should update soon if not
There was a problem hiding this comment.
Yep, so rust 2018 + rustfmt?
There was a problem hiding this comment.
the only thing is we’ve had a really great story for supporting older compilers so I’d like to see what the Linux distros are shipping at the moment. If we can target a minimum rustc/ cargo combination which does 2018 that would be ideal. Need to investigate.
| @@ -466,6 +472,7 @@ macro_rules! elf_dyn_std_impl { | |||
| pub fn from_fd(mut fd: &File, phdrs: &[$phdr]) -> Result<Option<Vec<Dyn>>> { | |||
| for phdr in phdrs { | |||
| if phdr.p_type == PT_DYNAMIC { | |||
| // FIXME: validate filesz before allocating | |||
There was a problem hiding this comment.
I think this method is only used by things that load off disk like a dynamic linker so it shouldn’t be on the parser code path; however yes we should do something here but I wouldn’t worry about it for now
|
I’ll let you push the merge button since it feels good :) |
This fixes all the errors that I could reproduce from #120.
TODO:
Vec::with_capacity