diff mbox series

libbacktrace patch committed: permit values at end of buffer

Message ID CAOyqgcVVNwEFi9V_jgQLfJtnKM75Pw_SU+8QrsBkaHaq=OzouA@mail.gmail.com
State New
Headers show
Series libbacktrace patch committed: permit values at end of buffer | expand

Commit Message

Ian Lance Taylor Dec. 2, 2020, 7:08 p.m. UTC 
A couple of buffer overflow checks in libbacktrace incorrectly used >=
when comparing the end of the value with the end of the buffer.  It is
of course OK if the value ends at the very end of the buffer.  This
patch corrects those cases to use > instead.  Bootstrapped and ran
libbacktrace and Go tests on x86_64-pc-linux-gnu.  Committed to
mainline.

Ian

* dwarf.c (resolve_string): Use > rather than >= to check whether
string index extends past buffer.
(resolve_addr_index): Similarly for address index.
2e7ce16d5156bab9c217d21e7ff17a6a6eaf6fd3
diff mbox series

Patch

diff --git a/libbacktrace/dwarf.c b/libbacktrace/dwarf.c
index 582f34bc816..0c913c95983 100644
--- a/libbacktrace/dwarf.c
+++ b/libbacktrace/dwarf.c
@@ -1053,7 +1053,7 @@  resolve_string (const struct dwarf_sections *dwarf_sections, int is_dwarf64,
 
 	offset = val->u.uint * (is_dwarf64 ? 8 : 4) + str_offsets_base;
 	if (offset + (is_dwarf64 ? 8 : 4)
-	    >= dwarf_sections->size[DEBUG_STR_OFFSETS])
+	    > dwarf_sections->size[DEBUG_STR_OFFSETS])
 	  {
 	    error_callback (data, "DW_FORM_strx value out of range", 0);
 	    return 0;
@@ -1097,7 +1097,7 @@  resolve_addr_index (const struct dwarf_sections *dwarf_sections,
   struct dwarf_buf addr_buf;
 
   offset = addr_index * addrsize + addr_base;
-  if (offset + addrsize >= dwarf_sections->size[DEBUG_ADDR])
+  if (offset + addrsize > dwarf_sections->size[DEBUG_ADDR])
     {
       error_callback (data, "DW_FORM_addrx value out of range", 0);
       return 0;