From: Mark Wielaard Date: Sun, 12 Jul 2026 12:07:05 +0000 (+0200) Subject: libdw: Fix __libdw_read_offset size in dwarf_getpubnames.c get_offsets X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c4bfb99c0a9e7736b4ac2f5effb3c9c56fcfd7e6;p=thirdparty%2Felfutils.git libdw: Fix __libdw_read_offset size in dwarf_getpubnames.c get_offsets There was a typo in the __libdw_read_offset call that meant it only checked there were 3 bytes available in .debug_info at the given offset instead of 4. This could result in a 1 byte overread. * libdw/dwarf_getpubnames.c (get_offsets): Call __libdw_read_offset with size 4. https://sourceware.org/bugzilla/show_bug.cgi?id=34392 Reported-by: Karan Kurani Signed-off-by: Mark Wielaard --- diff --git a/libdw/dwarf_getpubnames.c b/libdw/dwarf_getpubnames.c index de726407..94e624b2 100644 --- a/libdw/dwarf_getpubnames.c +++ b/libdw/dwarf_getpubnames.c @@ -105,7 +105,7 @@ get_offsets (Dwarf *dbg) /* Get the CU offset. */ if (__libdw_read_offset (dbg, dbg, IDX_debug_pubnames, readp + 2, len_bytes, - &mem[cnt].cu_offset, IDX_debug_info, 3)) + &mem[cnt].cu_offset, IDX_debug_info, 4)) /* Error has been already set in reader. */ goto err_return;