From 70f5da6cd480615718665e18f6d55c6d1caab1d5 Mon Sep 17 00:00:00 2001 From: Petr Machata Date: Wed, 19 Sep 2012 16:52:07 +0200 Subject: [PATCH] In mixed core notes, don't let handle_core_item repeat. If a core note contains both registers and items, descsz is 0 to express that we don't wish to repeat the items. If there is only one item in such note, a special block of code hits that passes &size to handle_core_item, which will decrease that size by the amount consumed by the item. But because size is 0, it underflows and wraps, and the loop following this block, which handles the common case, overruns the core note buffer. Signed-off-by: Petr Machata --- src/readelf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/readelf.c b/src/readelf.c index 2954e7427..5d167ebc7 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -7699,7 +7699,11 @@ handle_core_items (Elf *core, const void *desc, size_t descsz, if (nitems == 1) { size_t size = descsz; - colno = handle_core_item (core, sorted_items[0], desc, colno, &size); + /* If this note contains registers as well as items, don't pass + &size to express that we don't wish to repeat. */ + colno = handle_core_item (core, sorted_items[0], desc, colno, + size != 0 ? &size : NULL); + if (size == 0) return colno; desc += descsz - size; -- 2.47.2