Variable 'sh_entsize', whose possible value set allows a zero value by calling function 'gelf_fsize', is used as a denominator in calculation of 'nentries' variable.
Found by RASU JSC. Signed-off-by: Maks Mishin <maks.mishi...@gmail.com> --- src/readelf.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/readelf.c b/src/readelf.c index 0e931184..6701f5cf 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -2086,6 +2086,12 @@ handle_relocs_rel (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, GElf_Shdr *shdr) { int class = gelf_getclass (ebl->elf); size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT); + + if (sh_entsize == 0) { + printf (_("division by zero in handle_relocs_rel() function")); + return; + } + int nentries = shdr->sh_size / sh_entsize; /* Get the data of the section. */ @@ -2275,6 +2281,12 @@ handle_relocs_rela (Ebl *ebl, GElf_Ehdr *ehdr, Elf_Scn *scn, GElf_Shdr *shdr) { int class = gelf_getclass (ebl->elf); size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT); + + if (sh_entsize == 0) { + printf (_("division by zero in handle_relocs_rela() function")); + return; + } + int nentries = shdr->sh_size / sh_entsize; /* Get the data of the section. */ @@ -2469,6 +2481,12 @@ handle_relocs_relr (Ebl *ebl, Dwfl_Module *mod, Elf_Scn *scn, GElf_Shdr *shdr) { int class = gelf_getclass (ebl->elf); size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELR, 1, EV_CURRENT); + + if (sh_entsize == 0) { + printf (_("division by zero in handle_relocs_relr() function")); + return; + } + int nentries = shdr->sh_size / sh_entsize; /* Get the data of the section. */ -- 2.30.2