SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pe-binary: fix missing le16toh() on NumberOfSections in pe_hash/uki_hash

Browse Source 
pe_hash() and uki_hash() pass pe_header->pe.NumberOfSections directly
to typesafe_qsort() and FOREACH_ARRAY() without le16toh(). On
big-endian (s390x), NumberOfSections=3 gets read as 0x0300 (768),
while pe_load_sections() correctly converts it and only allocates 3
sections. This makes qsort process 768 elements on a 3-element
buffer, causing a heap-buffer-overflow (confirmed with ASAN on
native s390x).

Wrap all three raw usages with le16toh() to match pe_load_sections().
This commit is contained in:
Oblivionsage
2026-02-18 08:25:54 +09:00
committed by Yu Watanabe
parent a3af68b84d
commit 02cab70acf
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/pe-binary.c
+4 -4
View File
@@ -243,7 +243,7 @@ int pe_read_section_data_by_name(
assert(fd >= 0);
assert(pe_header);
assert(sections || pe_header->pe.NumberOfSections == 0);
assert(sections || le16toh(pe_header->pe.NumberOfSections) == 0);
assert(name);
section = pe_header_find_section(pe_header, sections, name);
@@ -408,9 +408,9 @@ int pe_hash(int fd,
return r;
/* Sort by location in file */
typesafe_qsort(sections, pe_header->pe.NumberOfSections, section_offset_cmp);
typesafe_qsort(sections, le16toh(pe_header->pe.NumberOfSections), section_offset_cmp);
FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
FOREACH_ARRAY(section, sections, le16toh(pe_header->pe.NumberOfSections)) {
r = hash_file(fd, mdctx, section->PointerToRawData, section->SizeOfRawData);
if (r < 0)
return r;
@@ -537,7 +537,7 @@ int uki_hash(int fd,
if (hsz < 0)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get hash size.");
FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
FOREACH_ARRAY(section, sections, le16toh(pe_header->pe.NumberOfSections)) {
_cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *mdctx = NULL;
_cleanup_free_ char *n = NULL;
ssize_t i;