Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

upx-devel ddos Vulnerability #317

Closed
freebufdaolang opened this issue Nov 21, 2019 · 1 comment
Closed

upx-devel ddos Vulnerability #317

freebufdaolang opened this issue Nov 21, 2019 · 1 comment
Milestone
v3.96

Comments

@freebufdaolang
Copy link

ubuntu 1604 x32
////////////////////////////////////////////////////////////
ddos 1 attachment p_lx_elf.cpp^%1613
p_lx_elf.cpp:1613
unsigned const nbucket = get_te32(&hashtab[0]); crashes
/////////////////////////////////////////////////////////////////////
ddos 2 attachment p_lx_elf.cpp^%1635
p_lx_elf.cpp:1635
unsigned const n_bucket = get_te32(&gashtab[0]);
unsigned const n_bitmask = get_te32(&gashtab[2]);
unsigned const gnu_shift = get_te32(&gashtab[3]);
////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////
ddos 3 attachment p_lx_elf.cpp^%1839
p_lx_elf.cpp^%1839
unsigned const symnum = get_te32(&rel->r_info) >> [8];

////////////////////////////////////////////////////////////////////////////

find by topsec(hj)

upx.zip
jreiser added a commit that referenced this issue Nov 24, 2019
@jreiser
Avoid bogus values in PT_DYNAMIC segment.
8be9da8 
Detect duplicate DT_*.
Detect out-of-bounds hashtab and gashtab.
Detect missing DT_REL, DT_RELA.
Detect out-of-bounds d_val.
#317
	modified:   p_lx_elf.cpp
@jreiser
Copy link
Collaborator

jreiser commented Nov 24, 2019

Fixed in devel branch.

upx.out: p_lx_elf.cpp^%1613: CantUnpackException: duplicate DT_0x5: [0x3] [0xb]
upx.out: p_lx_elf.cpp^%1635: CantUnpackException: bad DT_GNU_HASH 0x80481ac
upx.out: p_lx_elf.cpp^%1839: CantPackException: duplicate DT_0x6: [0x9] [0x11]

@jreiser jreiser closed this as completed Nov 29, 2019
@markus-oberhumer markus-oberhumer added this to the v3.96 milestone Jan 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
v3.96
Development

No branches or pull requests
3 participants
@markus-oberhumer @jreiser @freebufdaolang