From 3a5bbc919873fc8adee7345dd7dec585eb4d2547 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Wed, 30 May 2018 15:51:12 +0200 Subject: [PATCH] libdw: Fix overflow warning on 32bit systems with GCC8 in dwarf_getsrclines. ndirs is read from the debug data and should be size checked before use. https://sourceware.org/bugzilla/show_bug.cgi?id=23248 Signed-off-by: Mark Wielaard --- libdw/ChangeLog | 5 +++++ libdw/dwarf_getsrclines.c | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/libdw/ChangeLog b/libdw/ChangeLog index 38b45badd..d8433eb9d 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,3 +1,8 @@ +2018-05-30 Mark Wielaard + + * libdw/dwarf_getsrclines.c (read_srclines): Change ndir and + ndirlist to size_t. Add check to see ndirlist doesn't overflow. + 2018-05-31 Mark Wielaard * dwarf_dieoffset.c: Check die->cu != NULL. Return -1, not ~0ul diff --git a/libdw/dwarf_getsrclines.c b/libdw/dwarf_getsrclines.c index 2bf309849..790d4e49b 100644 --- a/libdw/dwarf_getsrclines.c +++ b/libdw/dwarf_getsrclines.c @@ -154,7 +154,7 @@ read_srclines (Dwarf *dbg, int res = -1; size_t nfilelist = 0; - unsigned int ndirlist = 0; + size_t ndirlist = 0; /* If there are a large number of lines, files or dirs don't blow up the stack. Stack allocate some entries, only dynamically malloc @@ -299,7 +299,7 @@ read_srclines (Dwarf *dbg, }; /* First count the entries. */ - unsigned int ndirs = 0; + size_t ndirs = 0; if (version < 5) { const unsigned char *dirp = linep; @@ -359,6 +359,8 @@ read_srclines (Dwarf *dbg, ndirlist = ndirs; if (ndirlist >= MAX_STACK_DIRS) { + if (ndirlist > SIZE_MAX / sizeof (*dirarray)) + goto no_mem; dirarray = (struct dirlist *) malloc (ndirlist * sizeof (*dirarray)); if (unlikely (dirarray == NULL)) { -- 2.47.3