@@ -3121,11 +3121,11 @@ static bool parse_elf_properties(const ImageSource *src,
}
/*
- * The contents of a valid PT_GNU_PROPERTY is a sequence
- * of uint32_t -- swap them all now.
+ * The contents of a valid PT_GNU_PROPERTY is a sequence of uint32_t.
+ * Swap most of them now, beyond the header and namesz.
*/
#ifdef BSWAP_NEEDED
- for (int i = 0; i < n / 4; i++) {
+ for (int i = 4; i < n / 4; i++) {
bswap32s(note.data + i);
}
#endif
@@ -3135,15 +3135,15 @@ static bool parse_elf_properties(const ImageSource *src,
* immediately follows nhdr and is thus at the 4th word. Further, all
* of the inputs to the kernel's round_up are multiples of 4.
*/
- if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 ||
- note.nhdr.n_namesz != NOTE_NAME_SZ ||
+ if (tswap32(note.nhdr.n_type) != NT_GNU_PROPERTY_TYPE_0 ||
+ tswap32(note.nhdr.n_namesz) != NOTE_NAME_SZ ||
note.data[3] != GNU0_MAGIC) {
error_setg(errp, "Invalid note in PT_GNU_PROPERTY");
return false;
}
off = sizeof(note.nhdr) + NOTE_NAME_SZ;
- datasz = note.nhdr.n_descsz + off;
+ datasz = tswap32(note.nhdr.n_descsz) + off;
if (datasz > n) {
error_setg(errp, "Invalid note size in PT_GNU_PROPERTY");
return false;