SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

linux-user: Fix parse_elf_properties GNU0_MAGIC check

Browse Source 
Comparing a string of 4 bytes only works in little-endian.

Adjust bulk bswap to only apply to the note payload.
Perform swapping of the note header manually; the magic
is defined so that it does not need a runtime swap.

Fixes: 83f990eb5adb ("linux-user/elfload: Parse NT_GNU_PROPERTY_TYPE_0 notes")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2596
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 2884596f5f385b5712c356310dd4125a089888a8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Richard Henderson 2024-10-05 09:01:22 -07:00 committed by Michael Tokarev
parent 18046fbec5
commit 167c8d374a
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
linux-user/elfload.c
View File

@ -3136,11 +3136,11 @@ static bool parse_elf_properties(const ImageSource *src,
} }
/* /*
* The contents of a valid PT_GNU_PROPERTY is a sequence * The contents of a valid PT_GNU_PROPERTY is a sequence of uint32_t.
* of uint32_t -- swap them all now. * Swap most of them now, beyond the header and namesz.
*/ */
#ifdef BSWAP_NEEDED #ifdef BSWAP_NEEDED
for (int i = 0; i < n / 4; i++) { for (int i = 4; i < n / 4; i++) {
bswap32s(note.data + i); bswap32s(note.data + i);
} }
#endif #endif
@ -3150,15 +3150,15 @@ static bool parse_elf_properties(const ImageSource *src,
* immediately follows nhdr and is thus at the 4th word. Further, all * immediately follows nhdr and is thus at the 4th word. Further, all
* of the inputs to the kernel's round_up are multiples of 4. * of the inputs to the kernel's round_up are multiples of 4.
*/ */
if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 || if (tswap32(note.nhdr.n_type) != NT_GNU_PROPERTY_TYPE_0 ||
note.nhdr.n_namesz != NOTE_NAME_SZ || tswap32(note.nhdr.n_namesz) != NOTE_NAME_SZ ||
note.data[3] != GNU0_MAGIC) { note.data[3] != GNU0_MAGIC) {
error_setg(errp, "Invalid note in PT_GNU_PROPERTY"); error_setg(errp, "Invalid note in PT_GNU_PROPERTY");
return false; return false;
} }
off = sizeof(note.nhdr) + NOTE_NAME_SZ; off = sizeof(note.nhdr) + NOTE_NAME_SZ;
datasz = note.nhdr.n_descsz + off; datasz = tswap32(note.nhdr.n_descsz) + off;
if (datasz > n) { if (datasz > n) {
error_setg(errp, "Invalid note size in PT_GNU_PROPERTY"); error_setg(errp, "Invalid note size in PT_GNU_PROPERTY");
return false; return false;