diff options
| author | Mark Wielaard <mark@klomp.org> | 2018-05-30 15:51:12 +0200 |
|---|---|---|
| committer | Mark Wielaard <mark@klomp.org> | 2018-05-31 21:42:25 +0200 |
| commit | 3a5bbc919873fc8adee7345dd7dec585eb4d2547 (patch) | |
| tree | 7c24d7d69c6fe785623947aa8767efd7ac4af0c7 /libdw | |
| parent | 84acd2365d4775b93aed5e5970b34db05ea5d547 (diff) | |
| download | elfutils-3a5bbc919873fc8adee7345dd7dec585eb4d2547.tar.gz | |
libdw: Fix overflow warning on 32bit systems with GCC8 in dwarf_getsrclines.
ndirs is read from the debug data and should be size checked before use.
https://sourceware.org/bugzilla/show_bug.cgi?id=23248
Signed-off-by: Mark Wielaard <mark@klomp.org>
Diffstat (limited to 'libdw')
| -rw-r--r-- | libdw/ChangeLog | 5 | ||||
| -rw-r--r-- | libdw/dwarf_getsrclines.c | 6 |
2 files changed, 9 insertions, 2 deletions
diff --git a/libdw/ChangeLog b/libdw/ChangeLog index 38b45bad..d8433eb9 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,3 +1,8 @@ +2018-05-30 Mark Wielaard <mark@klomp.org> + + * libdw/dwarf_getsrclines.c (read_srclines): Change ndir and + ndirlist to size_t. Add check to see ndirlist doesn't overflow. + 2018-05-31 Mark Wielaard <mark@klomp.org> * dwarf_dieoffset.c: Check die->cu != NULL. Return -1, not ~0ul diff --git a/libdw/dwarf_getsrclines.c b/libdw/dwarf_getsrclines.c index 2bf30984..790d4e49 100644 --- a/libdw/dwarf_getsrclines.c +++ b/libdw/dwarf_getsrclines.c @@ -154,7 +154,7 @@ read_srclines (Dwarf *dbg, int res = -1; size_t nfilelist = 0; - unsigned int ndirlist = 0; + size_t ndirlist = 0; /* If there are a large number of lines, files or dirs don't blow up the stack. Stack allocate some entries, only dynamically malloc @@ -299,7 +299,7 @@ read_srclines (Dwarf *dbg, }; /* First count the entries. */ - unsigned int ndirs = 0; + size_t ndirs = 0; if (version < 5) { const unsigned char *dirp = linep; @@ -359,6 +359,8 @@ read_srclines (Dwarf *dbg, ndirlist = ndirs; if (ndirlist >= MAX_STACK_DIRS) { + if (ndirlist > SIZE_MAX / sizeof (*dirarray)) + goto no_mem; dirarray = (struct dirlist *) malloc (ndirlist * sizeof (*dirarray)); if (unlikely (dirarray == NULL)) { |