forked from pool/libbpf
0aa7d66395
- Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941) + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534) + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533) + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606) + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch OBS-URL: https://build.opensuse.org/request/show/1034422 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libbpf?expand=0&rev=25
40 lines
1.3 KiB
Diff
40 lines
1.3 KiB
Diff
From 3a3ef0c1d09e1894740db71cdcb7be0bfd713671 Mon Sep 17 00:00:00 2001
|
|
From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
|
|
Date: Wed, 12 Oct 2022 10:23:53 +0800
|
|
Subject: [PATCH 4/4] libbpf: Fix null-pointer dereference in
|
|
find_prog_by_sec_insn()
|
|
|
|
When there are no program sections, obj->programs is left unallocated,
|
|
and find_prog_by_sec_insn()'s search lands on &obj->programs[0] == NULL,
|
|
and will cause null-pointer dereference in the following access to
|
|
prog->sec_idx.
|
|
|
|
Guard the search with obj->nr_programs similar to what's being done in
|
|
__bpf_program__iter() to prevent null-pointer access from happening.
|
|
|
|
Fixes: db2b8b06423c ("libbpf: Support CO-RE relocations for multi-prog sections")
|
|
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
|
|
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
|
|
Link: https://lore.kernel.org/bpf/20221012022353.7350-4-shung-hsi.yu@suse.com
|
|
---
|
|
src/libbpf.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/src/libbpf.c b/src/libbpf.c
|
|
index 29e9df0..8c3f236 100644
|
|
--- a/src/libbpf.c
|
|
+++ b/src/libbpf.c
|
|
@@ -4115,6 +4115,9 @@ static struct bpf_program *find_prog_by_sec_insn(const struct bpf_object *obj,
|
|
int l = 0, r = obj->nr_programs - 1, m;
|
|
struct bpf_program *prog;
|
|
|
|
+ if (!obj->nr_programs)
|
|
+ return NULL;
|
|
+
|
|
while (l < r) {
|
|
m = l + (r - l + 1) / 2;
|
|
prog = &obj->programs[m];
|
|
--
|
|
2.38.0
|
|
|