Skip to content

Commit 445c8fb

Browse files
committed
Bail out on partial reads, from Alexander Cherepanov
1 parent e96f86b commit 445c8fb

File tree

1 file changed

+9
-8
lines changed

1 file changed

+9
-8
lines changed

Diff for: src/readelf.c

+9-8
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
#include "file.h"
2828

2929
#ifndef lint
30-
FILE_RCSID("@(#)$File: readelf.c,v 1.113 2014/12/11 14:10:53 christos Exp $")
30+
FILE_RCSID("@(#)$File: readelf.c,v 1.114 2014/12/11 14:19:36 christos Exp $")
3131
#endif
3232

3333
#ifdef BUILTIN_ELF
@@ -319,7 +319,7 @@ dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
319319
* Loop through all the program headers.
320320
*/
321321
for ( ; num; num--) {
322-
if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
322+
if (pread(fd, xph_addr, xph_sizeof, off) < (ssize_t)xph_sizeof) {
323323
file_badread(ms);
324324
return -1;
325325
}
@@ -928,6 +928,7 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
928928
uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilites */
929929
uint64_t cap_sf1 = 0; /* SunOS 5.x software capabilites */
930930
char name[50];
931+
ssize_t namesize;
931932

932933
if (size != xsh_sizeof) {
933934
if (file_printf(ms, ", corrupted section header size") == -1)
@@ -936,23 +937,23 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
936937
}
937938

938939
/* Read offset of name section to be able to read section names later */
939-
if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) {
940+
if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) < (ssize_t)xsh_sizeof) {
940941
file_badread(ms);
941942
return -1;
942943
}
943944
name_off = xsh_offset;
944945

945946
for ( ; num; num--) {
946947
/* Read the name of this section. */
947-
if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) {
948+
if ((namesize = pread(fd, name, sizeof(name) - 1, name_off + xsh_name)) == -1) {
948949
file_badread(ms);
949950
return -1;
950951
}
951-
name[sizeof(name) - 1] = '\0';
952+
name[namesize] = '\0';
952953
if (strcmp(name, ".debug_info") == 0)
953954
stripped = 0;
954955

955-
if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) {
956+
if (pread(fd, xsh_addr, xsh_sizeof, off) < (ssize_t)xsh_sizeof) {
956957
file_badread(ms);
957958
return -1;
958959
}
@@ -982,7 +983,7 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
982983
" for note");
983984
return -1;
984985
}
985-
if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) {
986+
if (pread(fd, nbuf, xsh_size, xsh_offset) < (ssize_t)xsh_size) {
986987
file_badread(ms);
987988
free(nbuf);
988989
return -1;
@@ -1178,7 +1179,7 @@ dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
11781179
}
11791180

11801181
for ( ; num; num--) {
1181-
if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
1182+
if (pread(fd, xph_addr, xph_sizeof, off) < (ssize_t)xph_sizeof) {
11821183
file_badread(ms);
11831184
return -1;
11841185
}

0 commit comments

Comments
 (0)