Attachment 26516 Details for Bug 63576

[patch] foo.pat

foo.pat (text/plain), 1.05 KB, created by Marcus Meissner on 2004-11-29 18:16:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2004-11-29 18:16:22 UTC

Size: 1.05 KB

patch

obsolete

>Hi Dmitry!
>
>Dmitry V. Levin [2004-11-26  1:23 +0300]:
>> Hi,
>> 
>> Stack smashing bug in file/src/readelf.c:donote() mentioned in file's
>> changelog does not look so harmless.
>
>After a quick look I think the change in question is this one:
>
>--- file-4.10/src/readelf.c     2004-07-24 22:57:22.000000000 +0200
>+++ file-4.12/src/readelf.c     2004-11-24 18:38:24.000000000 +0100
>@@ -327,7 +326,7 @@
>        }
>
>        offset = ELF_ALIGN(doff + descsz);
>-       if (offset + descsz > size) {
>+       if (doff + descsz > size) {
>                return offset;
>        }
>
>The error is obvious (adding descsz twice to offset and use this wrong
>number to compare against size), but this will only cause "offset" to
>be returned in cases when it actually shouldn't. However, I do not
>understand why this can smash the stack. Does this cause any bad side
>effects?
>
>Thanks in advance for any enlightenment!
>
>Martin
>
>-- 
>Martin Pitt                       http://www.piware.de
>Ubuntu Developer            http://www.ubuntulinux.org
>Debian GNU/Linux Developer       http://www.debian.org

Actions: View | Diff

Attachments on bug 63576: 26516 | 26576 | 26577 | 26580 | 26581 | 26582 | 26583 | 26584 | 26602 | 26612 | 26613 | 26614 | 26615