+2018-10-24 Andreas Schwab <schwab@suse.de>
+
+ [BZ #18093]
+ * elf/dl-cache.c (_dl_load_cache_lookup): Check for truncated old
+ format cache.
+ * elf/cache.c (print_cache): Likewise.
+
2018-10-24 Albert ARIBAUD <albert.aribaud@3adev.fr>
* bits/timesize.h: New file.
}
else
{
+ /* Check for corruption, avoiding overflow. */
+ if ((cache_size - sizeof (struct cache_file)) / sizeof (struct file_entry)
+ < cache->nlibs)
+ error (EXIT_FAILURE, 0, _("File is not a cache file.\n"));
+
size_t offset = ALIGN_CACHE (sizeof (struct cache_file)
+ (cache->nlibs
* sizeof (struct file_entry)));
- only the new format
The following checks if the cache contains any of these formats. */
if (file != MAP_FAILED && cachesize > sizeof *cache
- && memcmp (file, CACHEMAGIC, sizeof CACHEMAGIC - 1) == 0)
+ && memcmp (file, CACHEMAGIC, sizeof CACHEMAGIC - 1) == 0
+ /* Check for corruption, avoiding overflow. */
+ && ((cachesize - sizeof *cache) / sizeof (struct file_entry)
+ >= ((struct cache_file *) file)->nlibs))
{
size_t offset;
/* Looks ok. */