[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 06/17] contrib/elf2dmp: add ELF dump header checking
From: |
Paolo Bonzini |
Subject: |
[PULL 06/17] contrib/elf2dmp: add ELF dump header checking |
Date: |
Wed, 25 May 2022 21:28:41 +0200 |
From: Viktor Prutyanov <viktor.prutyanov@redhat.com>
Add ELF header checking to prevent processing input file which is not
QEMU x86_64 guest memory dump or even not ELF.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1013
Signed-off-by: Viktor Prutyanov <viktor.prutyanov@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220520084339.171684-1-viktor.prutyanov@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
contrib/elf2dmp/qemu_elf.c | 53 ++++++++++++++++++++++++++++++++++++++
1 file changed, 53 insertions(+)
diff --git a/contrib/elf2dmp/qemu_elf.c b/contrib/elf2dmp/qemu_elf.c
index b601b6d7ba..ebda60dcb8 100644
--- a/contrib/elf2dmp/qemu_elf.c
+++ b/contrib/elf2dmp/qemu_elf.c
@@ -118,6 +118,53 @@ static void exit_states(QEMU_Elf *qe)
free(qe->state);
}
+static bool check_ehdr(QEMU_Elf *qe)
+{
+ Elf64_Ehdr *ehdr = qe->map;
+
+ if (sizeof(Elf64_Ehdr) > qe->size) {
+ eprintf("Invalid input dump file size\n");
+ return false;
+ }
+
+ if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) {
+ eprintf("Invalid ELF signature, input file is not ELF\n");
+ return false;
+ }
+
+ if (ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
+ ehdr->e_ident[EI_DATA] != ELFDATA2LSB) {
+ eprintf("Invalid ELF class or byte order, must be 64-bit LE\n");
+ return false;
+ }
+
+ if (ehdr->e_ident[EI_VERSION] != EV_CURRENT) {
+ eprintf("Invalid ELF version\n");
+ return false;
+ }
+
+ if (ehdr->e_machine != EM_X86_64) {
+ eprintf("Invalid input dump architecture, only x86_64 is supported\n");
+ return false;
+ }
+
+ if (ehdr->e_type != ET_CORE) {
+ eprintf("Invalid ELF type, must be core file\n");
+ return false;
+ }
+
+ /*
+ * ELF dump file must contain one PT_NOTE and at least one PT_LOAD to
+ * restore physical address space.
+ */
+ if (ehdr->e_phnum < 2) {
+ eprintf("Invalid number of ELF program headers\n");
+ return false;
+ }
+
+ return true;
+}
+
int QEMU_Elf_init(QEMU_Elf *qe, const char *filename)
{
GError *gerr = NULL;
@@ -133,6 +180,12 @@ int QEMU_Elf_init(QEMU_Elf *qe, const char *filename)
qe->map = g_mapped_file_get_contents(qe->gmf);
qe->size = g_mapped_file_get_length(qe->gmf);
+ if (!check_ehdr(qe)) {
+ eprintf("Input file has the wrong format\n");
+ err = 1;
+ goto out_unmap;
+ }
+
if (init_states(qe)) {
eprintf("Failed to extract QEMU CPU states\n");
err = 1;
--
2.36.1
- [PULL 00/17] Misc patches for 2022-05-25, Paolo Bonzini, 2022/05/25
- [PULL 01/17] target/i386: Remove LBREn bit check when access Arch LBR MSRs, Paolo Bonzini, 2022/05/25
- [PULL 02/17] hostmem: default the amount of prealloc-threads to smp-cpus, Paolo Bonzini, 2022/05/25
- [PULL 03/17] thread-pool: optimize scheduling of completion bottom half, Paolo Bonzini, 2022/05/25
- [PULL 04/17] thread-pool: replace semaphore with condition variable, Paolo Bonzini, 2022/05/25
- [PULL 05/17] thread-pool: remove stopping variable, Paolo Bonzini, 2022/05/25
- [PULL 06/17] contrib/elf2dmp: add ELF dump header checking,
Paolo Bonzini <=
- [PULL 08/17] hw/audio/ac97: Remove unimplemented reset functions, Paolo Bonzini, 2022/05/25
- [PULL 07/17] hw/audio/ac97: Coding style fixes to avoid checkpatch errors, Paolo Bonzini, 2022/05/25
- [PULL 09/17] hw/audio/ac97: Remove unneeded local variables, Paolo Bonzini, 2022/05/25
- [PULL 10/17] target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host, Paolo Bonzini, 2022/05/25
- [PULL 11/17] ide_ioport_read: Return lower octet of data register instead of 0xFF, Paolo Bonzini, 2022/05/25
- [PULL 12/17] i386: Use hv_build_cpuid_leaf() for HV_CPUID_NESTED_FEATURES, Paolo Bonzini, 2022/05/25
- [PULL 14/17] i386: Hyper-V XMM fast hypercall input feature, Paolo Bonzini, 2022/05/25
- [PULL 15/17] i386: Hyper-V Support extended GVA ranges for TLB flush hypercalls, Paolo Bonzini, 2022/05/25
- [PULL 13/17] i386: Hyper-V Enlightened MSR bitmap feature, Paolo Bonzini, 2022/05/25
- [PULL 16/17] i386: Hyper-V Direct TLB flush hypercall, Paolo Bonzini, 2022/05/25