From: Alan Modra <amodra@gmail.com>
Date: Sat, 17 Aug 2019 08:31:05 +0000 (+0930)
Subject: PR24911, Heap overflow issue in qsort_r, dwarf.c
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4bc59a5ab53c4cf43993e48d9a7eb5055d7b4e51;p=thirdparty%2Fbinutils-gdb.git

PR24911, Heap overflow issue in qsort_r, dwarf.c

The actual args to this function are "pointers to pointers to
debug_info".

	PR 24911
	* dwarf.c (comp_addr_base): Dereference args.

(cherry picked from commit d367307b93e5589245d1f2c8bbcfe709404540a8)
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 7fb60cc1ce8..a80a1fd4706 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2019-08-17  Alan Modra  <amodra@gmail.com>
+
+	PR 24911
+	* dwarf.c (comp_addr_base): Dereference args.
+
 2019-08-16  Alan Modra  <amodra@gmail.com>
 
 	PR 24909
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 36fa68004ca..d465b42366d 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -6470,8 +6470,8 @@ display_debug_aranges (struct dwarf_section *section,
 static int
 comp_addr_base (const void * v0, const void * v1)
 {
-  debug_info * info0 = (debug_info *) v0;
-  debug_info * info1 = (debug_info *) v1;
+  debug_info *info0 = *(debug_info **) v0;
+  debug_info *info1 = *(debug_info **) v1;
   return info0->addr_base - info1->addr_base;
 }