GetSectionHeader: bound the section-name read loop (matches GetSymbol fix from #32)#164
Open
nurdymuny wants to merge 5 commits into
Open
GetSectionHeader: bound the section-name read loop (matches GetSymbol fix from #32)#164nurdymuny wants to merge 5 commits into
nurdymuny wants to merge 5 commits into
Conversation
Reset MISSION_REV to 0xFF and build number to 1.
Initiate post v7.0.1 development cycle
…use-updated-static-analysis-workflow Part cFS/workflows#129, Use Updated Static Analysis Workflow
The fgetc loop that reads a section name from the ELF section header string table into the fixed 60-byte VerboseStr[60] buffer had no upper bound on the loop index. An input ELF whose string table contains a section-name string longer than 60 bytes (no early '\0') overflows the stack buffer. The sibling loop in GetSymbol() (line 1971) reads a symbol name into the same buffer using the correct '(i < sizeof(VerboseStr))' bound; that bound was added in 7584486 (Fix nasa#32, May 2020) but the same fix was never applied to the section-name loop a screen up. This applies the same fix shape — bound the loop, then explicitly nul-terminate after.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the
i < sizeof(VerboseStr)bound to the section-namefgetcloop inGetSectionHeader()and appends an explicit NUL terminator after the loop.This matches the fix that was applied to the identical loop in
GetSymbol()in commit
75844867(Fix #32, May 2020) — that pass touched the symbol-nameloop but missed the sibling section-name loop one screen up.
Without this bound, an ELF input whose section header string table contains
a string of 60+ non-NUL bytes overflows the fixed 60-byte stack buffer
VerboseStr[60].Diff
Tests
GetSymbol()loop at line 1971 whichuses the same buffer and same fix shape.
remain clean; this change closes one finding rather than introducing one.
Linked
Closes #163.