From 39f8614f17cd0a75dcf7739bde9b727ce3691296 Mon Sep 17 00:00:00 2001
From: alvaro <alvaro.felipe91@gmail.com>
Date: Mon, 3 Jul 2017 22:29:19 +0200
Subject: [PATCH] Added stream_size into section

This will allow to perform some security checks when reading size values
from ELF file

Fix crash e1ce7cecf01cf800397a4302854d9d76fa19763c
---
 elfio/elfio.hpp         |  9 +++------
 elfio/elfio_section.hpp | 17 ++++++++++++++++-
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/elfio/elfio.hpp b/elfio/elfio.hpp
index b5b9ed7..428d761 100644
--- a/elfio/elfio.hpp
+++ b/elfio/elfio.hpp
@@ -111,11 +111,9 @@ class elfio
     {
         clean();
 
-        unsigned char e_ident[EI_NIDENT];
-
-        // Read ELF file signature
-        stream.seekg( 0 );
-        stream.read( reinterpret_cast<char*>( &e_ident ), sizeof( e_ident ) );
+	unsigned char e_ident[EI_NIDENT];
+	// Read ELF file signature
+	stream.read( reinterpret_cast<char*>( &e_ident ), sizeof( e_ident ) );
 
         // Is it ELF file?
         if ( stream.gcount() != sizeof( e_ident ) ||
@@ -132,7 +130,6 @@ class elfio
         }
 
         convertor.setup( e_ident[EI_DATA] );
-
         header = create_header( e_ident[EI_CLASS], e_ident[EI_DATA] );
         if ( 0 == header ) {
             return false;
diff --git a/elfio/elfio_section.hpp b/elfio/elfio_section.hpp
index 99868ec..a226ba4 100644
--- a/elfio/elfio_section.hpp
+++ b/elfio/elfio_section.hpp
@@ -46,6 +46,16 @@ class section
     ELFIO_GET_SET_ACCESS_DECL( Elf_Xword,   size               );
     ELFIO_GET_SET_ACCESS_DECL( Elf_Word,    name_string_offset );
     ELFIO_GET_ACCESS_DECL    ( Elf64_Off,   offset             );
+    size_t stream_size;
+    const size_t get_stream_size() const 
+     {
+	return stream_size;
+     }
+
+    void set_stream_size(size_t value)
+     {
+	stream_size = value;
+     }
 
     virtual const char* get_data() const                                = 0;
     virtual void        set_data( const char* pData, Elf_Word size )    = 0;
@@ -224,11 +234,16 @@ class section_impl : public section
           std::streampos header_offset )
     {
         std::fill_n( reinterpret_cast<char*>( &header ), sizeof( header ), '\0' );
+
+	stream.seekg ( 0, stream.end );
+	set_stream_size ( stream.tellg() );
+
         stream.seekg( header_offset );
         stream.read( reinterpret_cast<char*>( &header ), sizeof( header ) );
 
+
         Elf_Xword size = get_size();
-        if ( 0 == data && SHT_NULL != get_type() && SHT_NOBITS != get_type() ) {
+        if ( 0 == data && SHT_NULL != get_type() && SHT_NOBITS != get_type() && size < get_stream_size()) {
             try {
                 data = new char[size];
             } catch (const std::bad_alloc&) {