diff options
| author |   Arthur Zamarin <arthurzam@gentoo.org> | 2026-08-31 20:22:13 +0300 |
|---|---|---|
| committer |   Mike Gilbert <floppym@gentoo.org> | 2026-09-01 14:17:07 -0400 |
| commit | 0a8e128bcadd04fba5c5f91be8016638522310f5 (patch) | |
| tree | 7e9310c11beb662f9acb21071055a4127f2de5f1 /.github | |
| parent | libsandbox: reject a file that is not an ELF before walking it (diff) | |
| download | sandbox-master.tar.gz sandbox-master.tar.bz2 sandbox-master.zip | |
sb_check_exec() reads a program's headers to decide whether it has to be
traced rather than run in-process, and took every offset in them at face
value. |e_phoff| was only weighed against the file size after the
program header pointer had been formed from it, and with the entry size
never compared against the structure being indexed and the entry count
folded in by a multiplication that can wrap, that check could pass for a
table that is not there. A PT_DYNAMIC entry was then followed to
wherever its |p_offset| pointed and read until something looked like a
DT_NULL, and the symbol and string table offsets were used unweighed as
well, so an ELF whose headers disagree with its length faulted the
process that is only trying to exec it.
Signed-off-by: Arthur Zamarin <arthurzam@gentoo.org>
Closes: https://github.com/gentoo/sandbox/pull/45
Signed-off-by: Mike Gilbert <floppym@gentoo.org>
Diffstat (limited to '.github')
0 files changed, 0 insertions, 0 deletions