diff options
Diffstat (limited to 'elf/dl-cache.c')
| -rw-r--r-- | elf/dl-cache.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/elf/dl-cache.c b/elf/dl-cache.c index 6ee5153ff9..6dd99a35b9 100644 --- a/elf/dl-cache.c +++ b/elf/dl-cache.c @@ -204,7 +204,10 @@ _dl_load_cache_lookup (const char *name) - only the new format The following checks if the cache contains any of these formats. */ if (file != MAP_FAILED && cachesize > sizeof *cache - && memcmp (file, CACHEMAGIC, sizeof CACHEMAGIC - 1) == 0) + && memcmp (file, CACHEMAGIC, sizeof CACHEMAGIC - 1) == 0 + /* Check for corruption, avoiding overflow. */ + && ((cachesize - sizeof *cache) / sizeof (struct file_entry) + >= ((struct cache_file *) file)->nlibs)) { size_t offset; /* Looks ok. */ |