Skip to content

Commit

Permalink
libbacktrace: correct buffer overflow tests
Browse files Browse the repository at this point in the history
	* dwarf.c (resolve_string): Use > rather than >= to check whether
	string index extends past buffer.
	(resolve_addr_index): Similarly for address index.
  • Loading branch information
ianlancetaylor committed Dec 4, 2020
1 parent f24e9f4 commit 1da441c
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions dwarf.c
Original file line number Diff line number Diff line change
Expand Up @@ -1386,7 +1386,7 @@ resolve_string (const struct dwarf_sections *dwarf_sections, int is_dwarf64,

offset = val->u.uint * (is_dwarf64 ? 8 : 4) + str_offsets_base;
if (offset + (is_dwarf64 ? 8 : 4)
>= dwarf_sections->size[DEBUG_STR_OFFSETS])
> dwarf_sections->size[DEBUG_STR_OFFSETS])
{
error_callback (data, "DW_FORM_strx value out of range", 0);
return 0;
Expand Down Expand Up @@ -1430,7 +1430,7 @@ resolve_addr_index (const struct dwarf_sections *dwarf_sections,
struct dwarf_buf addr_buf;

offset = addr_index * addrsize + addr_base;
if (offset + addrsize >= dwarf_sections->size[DEBUG_ADDR])
if (offset + addrsize > dwarf_sections->size[DEBUG_ADDR])
{
error_callback (data, "DW_FORM_addrx value out of range", 0);
return 0;
Expand Down

0 comments on commit 1da441c

Please sign in to comment.