[PATCH] elf: Limit program header count to 64 [BZ #21265]

[litenglong]

_dl_map_object_from_fd allocates 'loadcmds' on stack using e_phnum
from ELF header.  Large e_phnum (up to 65535) can cause excessive
stack allocation and overflow.

Fix by enforcing a limit of 64 program headers—ample for all practical
binaries.  Loading fails with "too many program headers" if exceeded.

Security fix for CVE-2017-1000366 (stack-clash).

Reviewed-by: gaoxiang <gaoxiang@kylinos.cn>
Signed-off-by: litenglong <litenglong@kylinos.cn>

Change-Id: I38bcbb179fdfd5134f3a3d9b6a473f3cf62c7afe
---
 elf/dl-load.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/elf/dl-load.c b/elf/dl-load.c
index 7355eef..7bd8033 100644
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -1099,6 +1099,12 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd,
 
   {
     /* Scan the program header table, collecting its load commands.  */
+    /* Reject unreasonable e_phnum values to prevent stack overflow via VLA. */
+    if (__glibc_unlikely (l->l_phnum > 64))
+      {
+        errstring = N_("too many program headers");
+        goto lose;
+      }
     struct loadcmd loadcmds[l->l_phnum];
     size_t nloadcmds = 0;
     bool has_holes = false;
-- 
2.25.1