mirror of
https://github.com/RGBCube/serenity
synced 2025-07-27 03:47:35 +00:00
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing
Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
This commit is contained in:
parent
9bf1fe9439
commit
78a63930cc
6 changed files with 37 additions and 9 deletions
|
@ -8,12 +8,21 @@
|
|||
|
||||
class ELFImage {
|
||||
public:
|
||||
explicit ELFImage(const u8*);
|
||||
explicit ELFImage(const u8*, size_t);
|
||||
~ELFImage();
|
||||
void dump() const;
|
||||
bool is_valid() const { return m_valid; }
|
||||
bool parse();
|
||||
|
||||
bool is_within_image(const void* address, size_t size)
|
||||
{
|
||||
if (address < m_buffer)
|
||||
return false;
|
||||
if (((const u8*)address + size) > m_buffer + m_size)
|
||||
return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
class Section;
|
||||
class RelocationSection;
|
||||
class Symbol;
|
||||
|
@ -190,6 +199,7 @@ private:
|
|||
const char* section_index_to_string(unsigned index) const;
|
||||
|
||||
const u8* m_buffer { nullptr };
|
||||
size_t m_size { 0 };
|
||||
HashMap<String, unsigned> m_sections;
|
||||
bool m_valid { false };
|
||||
unsigned m_symbol_table_section_index { 0 };
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue