libelf: Check pointer references in elf_is_elfbinary
authorIan Jackson <ian.jackson@eu.citrix.com>
Fri, 14 Jun 2013 15:39:36 +0000 (16:39 +0100)
committerIan Jackson <Ian.Jackson@eu.citrix.com>
Fri, 14 Jun 2013 15:39:36 +0000 (16:39 +0100)
commit943de71cf07d9d04ccb215bd46153b04930e9f25
tree0a2ac34b2bf39b2b4185ef398ee5471c73370540
parent65808a8ed41cc7c044f588bd6cab5af0fdc0e029
libelf: Check pointer references in elf_is_elfbinary

elf_is_elfbinary didn't take a length parameter and could potentially
access out of range when provided with a very short image.

We only need to check the size is enough for the actual dereference in
elf_is_elfbinary; callers are just using it to check the magic number
and do their own checks (usually via the new elf_ptrval system) before
dereferencing other parts of the header.

This is part of the fix to a security issue, XSA-55.

Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
v7: Add a comment about the limited function of elf_is_elfbinary.

v2: Style fix.
    Fix commit message subject.
tools/libxc/xc_dom_elfloader.c
xen/arch/x86/bzimage.c
xen/common/libelf/libelf-loader.c
xen/common/libelf/libelf-tools.c
xen/include/xen/libelf.h