diff options
| author | Alan Modra <amodra@gmail.com> | 2020-08-03 23:14:57 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2020-08-03 23:18:34 +0930 |
| commit | e44a1d7b9ad8d73f6cea1f20fe353fc12f9b8e66 (patch) | |
| tree | c9e8c4e7b0d6dca858c25630feb844739f861e64 /bfd/vms-lib.c | |
| parent | b5f386d52049067ca081651a460ab4ae85e327d4 (diff) | |
| download | gdb-e44a1d7b9ad8d73f6cea1f20fe353fc12f9b8e66.zip gdb-e44a1d7b9ad8d73f6cea1f20fe353fc12f9b8e66.tar.gz gdb-e44a1d7b9ad8d73f6cea1f20fe353fc12f9b8e66.tar.bz2 | |
asan: alpha-vms: buffer overflow in vms_traverse_index
* vms-lib.c (vms_traverse_index): Sanity check size remaining
before accessing vms_idx or vms_elfidx.
Diffstat (limited to 'bfd/vms-lib.c')
| -rw-r--r-- | bfd/vms-lib.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/bfd/vms-lib.c b/bfd/vms-lib.c index f000bc2..9379108 100644 --- a/bfd/vms-lib.c +++ b/bfd/vms-lib.c @@ -277,7 +277,8 @@ vms_traverse_index (bfd *abfd, unsigned int vbn, struct carsym_mem *cs, unsigned int flags; /* Extract key length. */ - if (bfd_libdata (abfd)->ver == LBR_MAJORID) + if (bfd_libdata (abfd)->ver == LBR_MAJORID + && offsetof (struct vms_idx, keyname) <= (size_t) (endp - p)) { struct vms_idx *ridx = (struct vms_idx *)p; @@ -288,7 +289,8 @@ vms_traverse_index (bfd *abfd, unsigned int vbn, struct carsym_mem *cs, flags = 0; keyname = ridx->keyname; } - else if (bfd_libdata (abfd)->ver == LBR_ELFMAJORID) + else if (bfd_libdata (abfd)->ver == LBR_ELFMAJORID + && offsetof (struct vms_elfidx, keyname) <= (size_t) (endp - p)) { struct vms_elfidx *ridx = (struct vms_elfidx *)p; |