ndirs is read from the debug data and should be size checked before use.
https://sourceware.org/bugzilla/show_bug.cgi?id=23248
Signed-off-by: Mark Wielaard <mark@klomp.org>
+2018-05-30 Mark Wielaard <mark@klomp.org>
+
+ * libdw/dwarf_getsrclines.c (read_srclines): Change ndir and
+ ndirlist to size_t. Add check to see ndirlist doesn't overflow.
+
2018-05-31 Mark Wielaard <mark@klomp.org>
* dwarf_dieoffset.c: Check die->cu != NULL. Return -1, not ~0ul
int res = -1;
size_t nfilelist = 0;
- unsigned int ndirlist = 0;
+ size_t ndirlist = 0;
/* If there are a large number of lines, files or dirs don't blow up
the stack. Stack allocate some entries, only dynamically malloc
};
/* First count the entries. */
- unsigned int ndirs = 0;
+ size_t ndirs = 0;
if (version < 5)
{
const unsigned char *dirp = linep;
ndirlist = ndirs;
if (ndirlist >= MAX_STACK_DIRS)
{
+ if (ndirlist > SIZE_MAX / sizeof (*dirarray))
+ goto no_mem;
dirarray = (struct dirlist *) malloc (ndirlist * sizeof (*dirarray));
if (unlikely (dirarray == NULL))
{