https://sourceware.org/bugzilla/show_bug.cgi?id=23248
--- Comment #3 from Mark Wielaard <mark at klomp dot org> ---
Martin pointed out that only works (on 64bit) if ndirlist was actually a size_t
(like nfilelist already is). So the full patch would be:
diff --git a/libdw/dwarf_getsrclines.c b/libdw/dwarf_getsrclines.c
index 2bf30984..790d4e49 100644
--- a/libdw/dwarf_getsrclines.c
+++ b/libdw/dwarf_getsrclines.c
@@ -154,7 +154,7 @@ read_srclines (Dwarf *dbg,
int res = -1;
size_t nfilelist = 0;
- unsigned int ndirlist = 0;
+ size_t ndirlist = 0;
/* If there are a large number of lines, files or dirs don't blow up
the stack. Stack allocate some entries, only dynamically malloc
@@ -299,7 +299,7 @@ read_srclines (Dwarf *dbg,
};
/* First count the entries. */
- unsigned int ndirs = 0;
+ size_t ndirs = 0;
if (version < 5)
{
const unsigned char *dirp = linep;
@@ -359,6 +359,8 @@ read_srclines (Dwarf *dbg,
ndirlist = ndirs;
if (ndirlist >= MAX_STACK_DIRS)
{
+ if (ndirlist > SIZE_MAX / sizeof (*dirarray))
+ goto no_mem;
dirarray = (struct dirlist *) malloc (ndirlist * sizeof (*dirarray));
if (unlikely (dirarray == NULL))
{
--
You are receiving this mail because:
You are on the CC list for the bug.
