From 372dd157272e0674d13372655cc60eaca9c06926 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Mon, 6 Jul 2020 09:00:29 +0930 Subject: [PATCH] asan: readelf: stack buffer overflow PR 26929 * readelf.c (print_dynamic_symbol): Don't sprintf to buffer to find string length. (cherry picked from commit ddb43bab174c50656331e5460b18bd8e8be5f522) --- binutils/ChangeLog | 8 ++++++++ binutils/readelf.c | 4 ++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/binutils/ChangeLog b/binutils/ChangeLog index a77c7a65276..9dc7136863f 100644 --- a/binutils/ChangeLog +++ b/binutils/ChangeLog @@ -1,3 +1,11 @@ +2020-11-22 Alan Modra + + PR 26929 + Apply from mainline + 2020-07-06 Alan Modra + * readelf.c (print_dynamic_symbol): Don't sprintf to buffer to + find string length. + 2020-11-16 Mark Wielaard Backport from the mainline: diff --git a/binutils/readelf.c b/binutils/readelf.c index 6057515a89b..41547a2594b 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -12091,9 +12091,9 @@ print_dynamic_symbol (Filedata *filedata, unsigned long si, int len_avail = 21; if (! do_wide && version_string != NULL) { - char buffer[256]; + char buffer[16]; - len_avail -= sprintf (buffer, "@%s", version_string); + len_avail -= 1 + strlen (version_string); if (sym_info == symbol_undefined) len_avail -= sprintf (buffer," (%d)", vna_other); -- 2.47.3