ndirs is read from the debug data and should be size checked before use.
https://sourceware.org/bugzilla/show_bug.cgi?id=23248
Signed-off-by: Mark Wielaard <m...@klomp.org>
---
libdw/ChangeLog | 5 +++++
libdw/dwarf_getsrclines.c | 6 ++++--
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 5a33d9c..c304a3b 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,8 @@
+2018-05-30 Mark Wielaard <m...@klomp.org>
+
+ * libdw/dwarf_getsrclines.c (read_srclines): Change ndir and
+ ndirlist to size_t. Add check to see ndirlist doesn't overflow.
+
2018-05-29 Mark Wielaard <m...@klomp.org>
* dwarf_cuoffset.c (dwarf_cuoffset): Check die->cu is not NULL.
diff --git a/libdw/dwarf_getsrclines.c b/libdw/dwarf_getsrclines.c
index 2bf3098..790d4e4 100644
--- a/libdw/dwarf_getsrclines.c
+++ b/libdw/dwarf_getsrclines.c
@@ -154,7 +154,7 @@ read_srclines (Dwarf *dbg,
int res = -1;
size_t nfilelist = 0;
- unsigned int ndirlist = 0;
+ size_t ndirlist = 0;
/* If there are a large number of lines, files or dirs don't blow up
the stack. Stack allocate some entries, only dynamically malloc
@@ -299,7 +299,7 @@ read_srclines (Dwarf *dbg,
};
/* First count the entries. */
- unsigned int ndirs = 0;
+ size_t ndirs = 0;
if (version < 5)
{
const unsigned char *dirp = linep;
@@ -359,6 +359,8 @@ read_srclines (Dwarf *dbg,
ndirlist = ndirs;
if (ndirlist >= MAX_STACK_DIRS)
{
+ if (ndirlist > SIZE_MAX / sizeof (*dirarray))
+ goto no_mem;
dirarray = (struct dirlist *) malloc (ndirlist * sizeof (*dirarray));
if (unlikely (dirarray == NULL))
{
--
1.8.3.1
