1 |
--- upx-3.94-src/src/p_lx_elf.cpp 2017-10-21 22:52:14.135024264 +0530 |
2 |
+++ upx-3.94-src/src/p_lx_elf.cpp 2017-10-21 22:52:14.135024264 +0530 |
3 |
@@ -245,8 +245,15 @@ |
4 |
sz_phdrs = 0; |
5 |
return; |
6 |
} |
7 |
+ if (0==e_phnum) throwCantUnpack("0==e_phnum"); |
8 |
e_phoff = get_te32(&ehdri.e_phoff); |
9 |
+ if ((unsigned long)file_size < ((unsigned long)e_phoff + e_phnum * sizeof(Elf32_Phdr))) { |
10 |
+ throwCantUnpack("bad e_phoff"); |
11 |
+ } |
12 |
e_shoff = get_te32(&ehdri.e_shoff); |
13 |
+ if ((unsigned long)file_size < ((unsigned long)e_shoff + e_shnum * sizeof(Elf32_Shdr))) { |
14 |
+ throwCantUnpack("bad e_shoff"); |
15 |
+ } |
16 |
sz_phdrs = e_phnum * e_phentsize; |
17 |
|
18 |
if (f && Elf32_Ehdr::ET_DYN!=e_type) { |
19 |
@@ -661,8 +668,15 @@ |
20 |
sz_phdrs = 0; |
21 |
return; |
22 |
} |
23 |
+ if (0==e_phnum) throwCantUnpack("0==e_phnum"); |
24 |
e_phoff = get_te64(&ehdri.e_phoff); |
25 |
+ if ((unsigned long)file_size < (e_phoff + e_phnum * sizeof(Elf64_Phdr))) { |
26 |
+ throwCantUnpack("bad e_phoff"); |
27 |
+ } |
28 |
e_shoff = get_te64(&ehdri.e_shoff); |
29 |
+ if ((unsigned long)file_size < (e_shoff + e_shnum * sizeof(Elf64_Shdr))) { |
30 |
+ throwCantUnpack("bad e_shoff"); |
31 |
+ } |
32 |
sz_phdrs = e_phnum * e_phentsize; |
33 |
|
34 |
if (f && Elf64_Ehdr::ET_DYN!=e_type) { |
35 |
@@ -3490,6 +3504,9 @@ |
36 |
|
37 |
void PackLinuxElf64::unpack(OutputFile *fo) |
38 |
{ |
39 |
+ if (e_phoff != sizeof(Elf64_Ehdr)) {// Phdrs not contiguous with Ehdr |
40 |
+ throwCantUnpack("bad e_phoff"); |
41 |
+ } |
42 |
unsigned const c_phnum = get_te16(&ehdri.e_phnum); |
43 |
upx_uint64_t old_data_off = 0; |
44 |
upx_uint64_t old_data_len = 0; |
45 |
@@ -4110,6 +4127,9 @@ |
46 |
|
47 |
void PackLinuxElf32::unpack(OutputFile *fo) |
48 |
{ |
49 |
+ if (e_phoff != sizeof(Elf32_Ehdr)) {// Phdrs not contiguous with Ehdr |
50 |
+ throwCantUnpack("bad e_phoff"); |
51 |
+ } |
52 |
unsigned const c_phnum = get_te16(&ehdri.e_phnum); |
53 |
unsigned old_data_off = 0; |
54 |
unsigned old_data_len = 0; |