PR24911, Heap overflow issue in qsort_r, dwarf.c

The actual args to this function are "pointers to pointers to
debug_info".

	PR 24911
	* dwarf.c (comp_addr_base): Dereference args.

(cherry picked from commit d367307b93e5589245d1f2c8bbcfe709404540a8)

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 7fb60cc1ce818df50b2646fca14e0ac90e06c246..a80a1fd47069331273633263dd2a301f2b183a0c 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2019-08-17  Alan Modra  <amodra@gmail.com>
+
+       PR 24911
+       * dwarf.c (comp_addr_base): Dereference args.
+
 2019-08-16  Alan Modra  <amodra@gmail.com>
 
        PR 24909

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 36fa68004ca3c60b60c993889e573c2ef0b009df..d465b42366d6c4e121f5958f4b1bcbc4c1d6ec2c 100644 (file)
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -6470,8 +6470,8 @@ display_debug_aranges (struct dwarf_section *section,
 static int
 comp_addr_base (const void * v0, const void * v1)
 {
-  debug_info * info0 = (debug_info *) v0;
-  debug_info * info1 = (debug_info *) v1;
+  debug_info *info0 = *(debug_info **) v0;
+  debug_info *info1 = *(debug_info **) v1;
   return info0->addr_base - info1->addr_base;
 }