add overflow check for vaddr

src/elf.rs

@@ -12,6 +12,7 @@ pub enum Error {
     BadMagic,
     BadType,
     BadMachine,
+    BadAddr,
 }
 
 struct Phdr {
@@ -101,15 +102,19 @@ pub fn load(elf: Vec<u8>, mem: &mut [u8]) -> Result<u32, Error> {
             continue;
         }
 
-        let vaddr = (phdr.vaddr - RAM_BASE) as usize;
-        let memsz = phdr.memsz as usize;
+        if let Some(vaddr) = phdr.vaddr.checked_sub(RAM_BASE) {
+            let vaddr = vaddr as usize;
+            let memsz = phdr.memsz as usize;
 
-        let pos = rdr.position();
-        rdr.set_position(phdr.offset as u64);
-        if rdr.read_exact(&mut mem[vaddr..vaddr + memsz]).is_err() {
-            return Err(Error::Eof);
+            let pos = rdr.position();
+            rdr.set_position(phdr.offset as u64);
+            if rdr.read_exact(&mut mem[vaddr..vaddr + memsz]).is_err() {
+                return Err(Error::Eof);
+            }
+            rdr.set_position(pos);
+        } else {
+            return Err(Error::BadAddr);
         }
-        rdr.set_position(pos);
     }
 
     Ok(entry)

src/lib.rs

@@ -336,6 +336,7 @@ pub fn run(path: String) -> Result<()> {
             elf::Error::BadMagic => bail!("bad magic"),
             elf::Error::BadType => bail!("invalid executable"),
             elf::Error::BadMachine => bail!("foreign elf architecture"),
+            elf::Error::BadAddr => bail!("bad virt address offset"),
         },
     };