1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
diff -ur linux-2.4.21/fs/binfmt_elf.c linux-2.4.21.plasmaroo/fs/binfmt_elf.c
--- linux-2.4.21/fs/binfmt_elf.c 2004-08-14 18:15:42.000000000 +0100
+++ linux-2.4.21.plasmaroo/fs/binfmt_elf.c 2004-11-19 20:48:27.314422552 +0000
@@ -299,9 +299,12 @@
goto out;
retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
- error = retval;
- if (retval < 0)
+ error = -EIO;
+ if (retval != size) {
+ if (retval < 0)
+ error = retval;
goto out_close;
+ }
eppnt = elf_phdata;
for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
@@ -473,8 +476,11 @@
goto out;
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
- if (retval < 0)
+ if (retval != size) {
+ if (retval >= 0)
+ retval = -EIO;
goto out_free_ph;
+ }
retval = get_unused_fd();
if (retval < 0)
@@ -499,7 +505,8 @@
*/
retval = -ENOMEM;
- if (elf_ppnt->p_filesz > PATH_MAX)
+ if (elf_ppnt->p_filesz > PATH_MAX ||
+ elf_ppnt->p_filesz == 0)
goto out_free_file;
elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
GFP_KERNEL);
@@ -509,8 +516,16 @@
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);
- if (retval < 0)
+ if (retval != elf_ppnt->p_filesz) {
+ if (retval >= 0)
+ retval = -EIO;
+ goto out_free_interp;
+ }
+ /* make sure path is NULL terminated */
+ retval = -EINVAL;
+ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
goto out_free_interp;
+
/* If the program interpreter is one of these two,
* then assume an iBCS2 image. Otherwise assume
* a native linux image.
@@ -529,8 +544,11 @@
if (IS_ERR(interpreter))
goto out_free_interp;
retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
- if (retval < 0)
+ if (retval != BINPRM_BUF_SIZE) {
+ if (retval >= 0)
+ retval = -EIO;
goto out_free_dentry;
+ }
/* Get the exec headers */
interp_ex = *((struct exec *) bprm->buf);
@@ -967,7 +982,10 @@
#endif
if (BAD_ADDR(error))
- continue;
+ {
+ send_sig(SIGKILL, current, 0);
+ goto out_free_dentry;
+ }
/* PaX: mirror at a randomized base */
down_write(¤t->mm->mmap_sem);
@@ -1008,7 +1026,10 @@
{
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
if (BAD_ADDR(error))
- continue;
+ {
+ send_sig(SIGKILL, current, 0);
+ goto out_free_dentry;
+ }
}
if (!load_addr_set) {
|
GitWeb