From: Alan Modra <amodra@gmail.com>
Date: Sun, 5 Jul 2020 23:30:29 +0000 (+0930)
Subject: asan: readelf: stack buffer overflow
X-Git-Tag: binutils-2_35_2~71
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=372dd157272e0674d13372655cc60eaca9c06926;p=thirdparty%2Fbinutils-gdb.git

asan: readelf: stack buffer overflow

	PR 26929
	* readelf.c (print_dynamic_symbol): Don't sprintf to buffer to
	find string length.

(cherry picked from commit ddb43bab174c50656331e5460b18bd8e8be5f522)
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index a77c7a65276..9dc7136863f 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,11 @@
+2020-11-22  Alan Modra  <amodra@gmail.com>
+
+	PR 26929
+	Apply from mainline
+	2020-07-06  Alan Modra  <amodra@gmail.com>
+	* readelf.c (print_dynamic_symbol): Don't sprintf to buffer to
+	find string length.
+
 2020-11-16  Mark Wielaard  <mark@klomp.org>
 
 	Backport from the mainline:
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 6057515a89b..41547a2594b 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -12091,9 +12091,9 @@ print_dynamic_symbol (Filedata *filedata, unsigned long si,
   int len_avail = 21;
   if (! do_wide && version_string != NULL)
     {
-      char buffer[256];
+      char buffer[16];
 
-      len_avail -= sprintf (buffer, "@%s", version_string);
+      len_avail -= 1 + strlen (version_string);
 
       if (sym_info == symbol_undefined)
 	len_avail -= sprintf (buffer," (%d)", vna_other);