* PR26741, benign use after free in riscv_parse_prefixed_ext
@ 2021-01-04 0:40 Alan Modra
2021-01-22 3:10 ` Nelson Chu
0 siblings, 1 reply; 2+ messages in thread
From: Alan Modra @ 2021-01-04 0:40 UTC (permalink / raw)
To: binutils
ISO/IEC 9899:1999 C standard "J.2 Undefined behavior" says the
following is undefined behaviour:
"The value of a pointer that refers to space deallocated by a call to
the free or realloc function is used (7.20.3)."
PR 26741
* elfxx-riscv.c (riscv_parse_prefixed_ext): Free subset after
calculating subset version length.
diff --git a/bfd/elfxx-riscv.c b/bfd/elfxx-riscv.c
index 9d7f606995..101e27f820 100644
--- a/bfd/elfxx-riscv.c
+++ b/bfd/elfxx-riscv.c
@@ -1572,8 +1572,8 @@ riscv_parse_prefixed_ext (riscv_parse_subset_t *rps,
riscv_parse_add_subset (rps, subset,
major_version,
minor_version, FALSE);
- free (subset);
p += end_of_version - subset;
+ free (subset);
if (*p != '\0' && *p != '_')
{
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: PR26741, benign use after free in riscv_parse_prefixed_ext
2021-01-04 0:40 PR26741, benign use after free in riscv_parse_prefixed_ext Alan Modra
@ 2021-01-22 3:10 ` Nelson Chu
0 siblings, 0 replies; 2+ messages in thread
From: Nelson Chu @ 2021-01-22 3:10 UTC (permalink / raw)
To: Alan Modra; +Cc: Binutils
Hi Alan,
Thanks for fixing this.
Nelson
On Mon, Jan 4, 2021 at 8:40 AM Alan Modra via Binutils
<binutils@sourceware.org> wrote:
>
> ISO/IEC 9899:1999 C standard "J.2 Undefined behavior" says the
> following is undefined behaviour:
>
> "The value of a pointer that refers to space deallocated by a call to
> the free or realloc function is used (7.20.3)."
>
> PR 26741
> * elfxx-riscv.c (riscv_parse_prefixed_ext): Free subset after
> calculating subset version length.
>
> diff --git a/bfd/elfxx-riscv.c b/bfd/elfxx-riscv.c
> index 9d7f606995..101e27f820 100644
> --- a/bfd/elfxx-riscv.c
> +++ b/bfd/elfxx-riscv.c
> @@ -1572,8 +1572,8 @@ riscv_parse_prefixed_ext (riscv_parse_subset_t *rps,
> riscv_parse_add_subset (rps, subset,
> major_version,
> minor_version, FALSE);
> - free (subset);
> p += end_of_version - subset;
> + free (subset);
>
> if (*p != '\0' && *p != '_')
> {
>
> --
> Alan Modra
> Australia Development Lab, IBM
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-01-22 3:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-04 0:40 PR26741, benign use after free in riscv_parse_prefixed_ext Alan Modra
2021-01-22 3:10 ` Nelson Chu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).