Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1446949

[PATCH v3 03/12] binfmt_flat: prevent kernel dammage from corrupted executable headers

Show all headers | View raw

Signed-off-by: Nicolas Pitre <nico@linaro.org>
---
 fs/binfmt_flat.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 36f5bb6b2c..9c76d9a222 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -470,6 +470,17 @@ static int load_flat_file(struct linux_binprm * bprm,
 	}
 
 	/*
+	 * Make sure the header params are sane.
+	 * 28 bits (256 MB) is way more than reasonable in this case.
+	 * If some top bits are set we have probable binary corruption.
+	*/
+	if ((text_len | data_len | bss_len | stack_len | full_data) >> 28) {
+		pr_err("bad header\n");
+		ret = -ENOEXEC;
+		goto err;
+	}
+
+	/*
 	 * fix up the flags for the older format,  there were all kinds
 	 * of endian hacks,  this only works for the simple cases
 	 */
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 00/12] allow BFLT executables on systems with a MMU Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 01/12] binfmt_flat: assorted cleanups Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 03/12] binfmt_flat: prevent kernel dammage from corrupted executable headers Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 02/12] binfmt_flat: convert printk invocations to their modern form Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
    Re: [PATCH v3 02/12] binfmt_flat: convert printk invocations to  their modern form Joe Perches <joe@perches.com> - 2016-07-20 06:40 +0200
      Re: [PATCH v3 02/12] binfmt_flat: convert printk invocations to  their modern form Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 07:10 +0200
  [PATCH v3 08/12] binfmt_flat: use proper user space accessors with old relocs code Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 04/12] elf_fdpic_transfer_args_to_stack(): make it generic Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 12/12] binfmt_flat: allow compressed flat binary format to work on MMU systems Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 05/12] binfmt_flat: use generic transfer_args_to_stack() Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 10/12] binfmt_flat: update libraries' data segment pointer with userspace accessors Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 06/12] binfmt_flat: clean up create_flat_tables() and stack accesses Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 07/12] binfmt_flat: use proper user space accessors with relocs processing code Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
  [PATCH v3 09/12] binfmt_flat: use clear_user() rather than memset() to clear .bss Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200
    Re: [PATCH v3 09/12] binfmt_flat: use clear_user() rather than  memset() to clear .bss Greg Ungerer <gerg@linux-m68k.org> - 2016-07-20 09:20 +0200
  [PATCH v3 11/12] binfmt_flat: add MMU-specific support Nicolas Pitre <nicolas.pitre@linaro.org> - 2016-07-20 06:30 +0200

csiph-web