From 38b520ab4c83563f72bc6293e260842f30e0c326 Mon Sep 17 00:00:00 2001 From: Alexander Egorenkov Date: Sat, 7 Aug 2021 18:45:12 +0200 Subject: [PATCH] zdump/dfi_elf: Don't accept ELF input with zero-sized PT_LOAD segments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The DFI memory chunk manager cannot handle PT_LOAD segments of size 0. This can lead to a NULL pointer access in mem_chunk_find() in case zgetdump is given an invalid VMCORE ELF file as input which contains only zero-sized ELF PT_LOAD segments. Instead of crashing, show an error message and terminate gracefully. The TELA test dump_with_zero_sized_segments.sh can reproduce this bug. Signed-off-by: Alexander Egorenkov Signed-off-by: Jan Höppner --- zdump/dfi_elf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/zdump/dfi_elf.c b/zdump/dfi_elf.c index fb2fc08a..7d098955 100644 --- a/zdump/dfi_elf.c +++ b/zdump/dfi_elf.c @@ -42,6 +42,8 @@ static int pt_load_add(Elf64_Phdr *phdr) STDERR("Dump file \"%s\" is a user space core dump\n", g.opts.device); } + if (phdr->p_memsz == 0) + return -EINVAL; if (phdr->p_offset + phdr->p_filesz > zg_size(g.fh)) return -EINVAL; if (phdr->p_filesz == 0) {