forked from rpms/glibc
21 lines
848 B
Diff
21 lines
848 B
Diff
diff -rup a/elf/dl-load.c b/elf/dl-load.c
|
|
--- a/elf/dl-load.c 2012-02-03 10:59:58.917870716 -0700
|
|
+++ b/elf/dl-load.c 2012-02-03 11:01:01.796580644 -0700
|
|
@@ -1130,6 +1130,16 @@ _dl_map_object_from_fd (const char *name
|
|
= N_("ELF load command address/offset not properly aligned");
|
|
goto call_lose;
|
|
}
|
|
+ if (__glibc_unlikely (ph->p_offset + ph->p_filesz > st.st_size))
|
|
+ {
|
|
+ /* If the segment requires zeroing of part of its last
|
|
+ page, we'll crash when accessing the unmapped page.
|
|
+ There's still a possibility of a race, if the shared
|
|
+ object is truncated between the fxstat above and the
|
|
+ memset below. */
|
|
+ errstring = N_("ELF load command past end of file");
|
|
+ goto call_lose;
|
|
+ }
|
|
|
|
struct loadcmd *c = &loadcmds[nloadcmds++];
|
|
c->mapstart = ph->p_vaddr & ~(GLRO(dl_pagesize) - 1);
|