]> git.ipfire.org Git - thirdparty/elfutils.git/commit
x86: Fix out-of-bounds heap write in sample_perf_regs_mapping
authorSayed Kaif <skaif@digiscrypt.com>
Fri, 19 Jun 2026 08:49:45 +0000 (14:19 +0530)
committerMark Wielaard <mark@klomp.org>
Fri, 19 Jun 2026 12:03:29 +0000 (14:03 +0200)
commita532f8dc338c26cc436bb7ea265c306aa21dfd37
treed6c2ca8232334c919e37326efb4fb4f15033fb7b
parent0e8b57aa36d80fd8e366c6e22f5bc96fdfe7c062
x86: Fix out-of-bounds heap write in sample_perf_regs_mapping

x86_sample_perf_regs_mapping initialized perf_to_regs[] only up to the
highest set bit of perf_regs_mask, but indexed it with dwarf_to_perf[i]
values up to PERF_REG_X86_64_MAX-1. For a sample carrying only the base
GP registers the upper slots stay uninitialized, and the resulting index
j was used unchecked to write cached_regs_mapping[j], a count-element
calloc buffer. Initialize the whole perf_to_regs[] array to -1, bounds-
check j before the write, and check calloc for failure.

* backends/x86_initreg_sample.c (x86_sample_perf_regs_mapping):
Initialize full perf_to_regs array, bounds-check index, check
calloc result.

Signed-off-by: Sayed Kaif <skaif@digiscrypt.com>
backends/x86_initreg_sample.c