diff options
| author | Alan Modra <amodra@gmail.com> | 2021-01-04 10:19:14 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2021-01-04 11:08:05 +1030 |
| commit | e9cf3691bfa140469d52815a2307b00eecf7917c (patch) | |
| tree | 5a08c301a555a464e6b84b140587af87966c36e5 /bfd/elfxx-riscv.c | |
| parent | a7c23ac9317e590893906a4b425ea1344eafdc52 (diff) | |
| download | gdb-e9cf3691bfa140469d52815a2307b00eecf7917c.zip gdb-e9cf3691bfa140469d52815a2307b00eecf7917c.tar.gz gdb-e9cf3691bfa140469d52815a2307b00eecf7917c.tar.bz2 | |
PR26741, benign use after free in riscv_parse_prefixed_ext
ISO/IEC 9899:1999 C standard "J.2 Undefined behavior" says the
following is undefined behaviour:
"The value of a pointer that refers to space deallocated by a call to
the free or realloc function is used (7.20.3)."
PR 26741
* elfxx-riscv.c (riscv_parse_prefixed_ext): Free subset after
calculating subset version length.
Diffstat (limited to 'bfd/elfxx-riscv.c')
| -rw-r--r-- | bfd/elfxx-riscv.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/bfd/elfxx-riscv.c b/bfd/elfxx-riscv.c index 9d7f606..101e27f 100644 --- a/bfd/elfxx-riscv.c +++ b/bfd/elfxx-riscv.c @@ -1572,8 +1572,8 @@ riscv_parse_prefixed_ext (riscv_parse_subset_t *rps, riscv_parse_add_subset (rps, subset, major_version, minor_version, FALSE); - free (subset); p += end_of_version - subset; + free (subset); if (*p != '\0' && *p != '_') { |