X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=src%2Fuserprog%2Fprocess.c;h=90ff18b14ddaae54563ee7d53d6c0cef538fe5aa;hb=f09c875281ab27bd51e1da5f97d327d69695ccec;hp=78b3122b1b6e1dcb1db9ce12d804e46383785a71;hpb=3758359883902d562e88cf8ee05d6a1a3e890e1b;p=pintos-anon

diff --git a/src/userprog/process.c b/src/userprog/process.c
index 78b3122..90ff18b 100644
--- a/src/userprog/process.c
+++ b/src/userprog/process.c
@@ -240,7 +240,10 @@ load (const char *filename, void (**eip) (void), void **esp)
     {
       struct Elf32_Phdr phdr;
 
+      if (file_ofs < 0 || file_ofs > file_length (file))
+        LOAD_ERROR (("bad file offset %ld", (long) file_ofs));
       file_seek (file, file_ofs);
+
       if (file_read (file, &phdr, sizeof phdr) != sizeof phdr)
         LOAD_ERROR (("error reading program header"));
       file_ofs += sizeof phdr;
@@ -316,6 +319,13 @@ load_segment (struct file *file, const struct Elf32_Phdr *phdr)
       return false; 
     }
 
+  /* p_offset must point within file. */
+  if (phdr->p_offset > (Elf32_Off) file_length (file)) 
+    {
+      printf ("bad p_offset %"PE32Ox, phdr->p_offset);
+      return false;
+    }
+
   /* [ELF1] 2-3 says that p_memsz must be at least as big as
      p_filesz. */
   if (phdr->p_memsz < phdr->p_filesz)