Re: [Xen-devel] [PATCH 09/16] libelf: check nul-terminated strings properly

[Matthew Daley <mattjd@xxxxxxxxx>]

On Tue, Jun 4, 2013 at 3:41 AM, Ian Jackson <ian.jackson@xxxxxxxxxxxxx> wrote:
> @@ -103,10 +103,13 @@ static int print_notes(struct elf_binary *elf, 
> ELF_HANDLE_DECL(elf_note) start,
>  {
>         ELF_HANDLE_DECL(elf_note) note;
>         int notes_found = 0;
> +       const char *this_note_name;
>
>         for ( note = start; ELF_HANDLE_PTRVAL(note) < ELF_HANDLE_PTRVAL(end); 
> note = elf_note_next(elf, note) )
>         {
> -               if (0 != strcmp(elf_note_name(elf, note), "Xen"))
> +               this_note_name = elf_note_name(elf, note);
> +               if (NULL == this_note_name ||

Should be break in this case, not continue, otherwise a invalid large
elf note section will make the loop run for a long time.

> @@ -227,7 +231,10 @@ static int elf_xen_parse_notes(struct elf_binary *elf,
>            ELF_HANDLE_PTRVAL(note) < parms->elf_note_end;
>            note = elf_note_next(elf, note) )
>      {
> -        if ( strcmp(elf_note_name(elf, note), "Xen") )
> +        note_name = elf_note_name(elf, note);
> +        if ( note_name == NULL )
> +            continue;

Similarly, should be break, not continue.

(For my reference: this is crashsig f08825f)

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel