From: Alan Modra <amodra@gmail.com>
Date: Sat, 17 Aug 2019 08:31:05 +0000 (+0930)
Subject: PR24911, Heap overflow issue in qsort_r, dwarf.c
X-Git-Tag: binutils-2_33~178
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d367307b93e5589245d1f2c8bbcfe709404540a8;p=thirdparty%2Fbinutils-gdb.git

PR24911, Heap overflow issue in qsort_r, dwarf.c

The actual args to this function are "pointers to pointers to
debug_info".

	PR 24911
	* dwarf.c (comp_addr_base): Dereference args.
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index cf8eea7fca2..7605a403956 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2019-08-17  Alan Modra  <amodra@gmail.com>
+
+	PR 24911
+	* dwarf.c (comp_addr_base): Dereference args.
+
 2019-08-16  Alan Modra  <amodra@gmail.com>
 
 	PR 24909
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index d63383271b7..b4738ebb8d3 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -6545,8 +6545,8 @@ display_debug_aranges (struct dwarf_section *section,
 static int
 comp_addr_base (const void * v0, const void * v1)
 {
-  debug_info * info0 = (debug_info *) v0;
-  debug_info * info1 = (debug_info *) v1;
+  debug_info *info0 = *(debug_info **) v0;
+  debug_info *info1 = *(debug_info **) v1;
   return info0->addr_base - info1->addr_base;
 }