From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) by sourceware.org (Postfix) with ESMTPS id 703E63858C20 for ; Wed, 12 Apr 2023 01:34:12 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 703E63858C20 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pl1-x62f.google.com with SMTP id d9443c01a7336-1a6674bcad4so943165ad.1 for ; Tue, 11 Apr 2023 18:34:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1681263251; x=1683855251; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=iAtRJ38xL5e+z5pZG3Dze3j0v+lX5XfAdyE/BRi1ZBg=; b=FwGTT7TqD7T06jC3o3XpIaYXlW8fa2pk+Vhfi0PF4N/Mrh3l4ix7eVGZDlCdEPzPPz 8z9kgvNtGPwmxrgwVXOHKqkeTBQDHojZxgclTF5pVdNKAN3pLDSlDpE4SFTArPs88tFZ Fb5U+KdkaEfUKBfRvRQfrUO3Vu9gX7fYf+PA2RCzp+uQniGWMFuOSEIsDt9t00lPY5dk oZrFLMSDuOicpQe9aUJ8HJ680qhKjYV7+oKoaodCNk6KxjvGlZDC+8S5sh7TteO5WgBL KcXeoE0q8OizhlR/VHoBbaZpsmBwgSzih3YLGqnNovM6F0P5xDGieXhCrC6Gr/W703to jbDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1681263251; x=1683855251; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=iAtRJ38xL5e+z5pZG3Dze3j0v+lX5XfAdyE/BRi1ZBg=; b=Xpcep4FigrJJI9V/ZG7cNtid90Yahrrd+H9QXHG0RLT3kYLcIHXxKZsD5iaVMeTBdO PgSc6e4QkYK2a+o2gVRBbnHch9juMBZA8DSSA+YJvdYN+wIVBX1Qc8X7WfXHdRu8BTdd NkoU3H6cF7H3EIYdUHnsrK6S3GW10iEznrrwkBtd8N737NvPCpaJusQdBOlCmoQ2r7D8 Uz09fDBuuhD+T3v5LfcwTZT7u5DCbBV24vmTjGNN8dYHwH4H2Qgyd9m6E6WiUx0OwVub 7kdlHflmgjJtvXH4M8WnmVAABwXWve05O8+aqmqMXh73wesKCPUC/yTnien6Z7HnFX2a MUBA== X-Gm-Message-State: AAQBX9f+MuPKRG2JQg1JahbCv1A+6xnf/9nYN48cpQ1cInI+33pXaUJB 9saWzBo3xhBqdvDVHJyBBfKyjPXbEcU= X-Google-Smtp-Source: AKy350bYgAURN42HOcPJf4bZDeMWF+oqEQDtNWBxThPo/x/fcVg6rWDmNxrUriBGd7t3jGQt+9Hf/g== X-Received: by 2002:a62:1ac1:0:b0:62d:d6ca:5834 with SMTP id a184-20020a621ac1000000b0062dd6ca5834mr18306579pfa.16.1681263250986; Tue, 11 Apr 2023 18:34:10 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id 25-20020aa79119000000b005ac419804d3sm10439779pfh.186.2023.04.11.18.34.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Apr 2023 18:34:10 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 4B4AD11432A7; Wed, 12 Apr 2023 11:04:08 +0930 (ACST) Date: Wed, 12 Apr 2023 11:04:08 +0930 From: Alan Modra To: binutils@sourceware.org Subject: ubsan: dwarf2.c:2232:7: runtime error: index 16 out of bounds Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-3035.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Except it isn't out of bounds because space for a larger array has been allocated. * dwarf2.c (struct trie_leaf): Make ranges a C99 flexible array. (alloc_trie_leaf, insert_arange_in_trie): Adjust sizing. diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c index d99508a96c7..b135ef09120 100644 --- a/bfd/dwarf2.c +++ b/bfd/dwarf2.c @@ -137,7 +137,7 @@ struct trie_leaf struct { struct comp_unit *unit; bfd_vma low_pc, high_pc; - } ranges[TRIE_LEAF_SIZE]; + } ranges[]; }; struct trie_interior @@ -148,7 +148,9 @@ struct trie_interior static struct trie_node *alloc_trie_leaf (bfd *abfd) { - struct trie_leaf *leaf = bfd_zalloc (abfd, sizeof (struct trie_leaf)); + struct trie_leaf *leaf; + size_t amt = sizeof (*leaf) + TRIE_LEAF_SIZE * sizeof (leaf->ranges[0]); + leaf = bfd_zalloc (abfd, amt); if (leaf == NULL) return NULL; leaf->head.num_room_in_leaf = TRIE_LEAF_SIZE; @@ -2207,9 +2209,7 @@ insert_arange_in_trie (bfd *abfd, const struct trie_leaf *leaf = (struct trie_leaf *) trie; unsigned int new_room_in_leaf = trie->num_room_in_leaf * 2; struct trie_leaf *new_leaf; - size_t amt = (sizeof (struct trie_leaf) - + ((new_room_in_leaf - TRIE_LEAF_SIZE) - * sizeof (leaf->ranges[0]))); + size_t amt = sizeof (*leaf) + new_room_in_leaf * sizeof (leaf->ranges[0]); new_leaf = bfd_zalloc (abfd, amt); new_leaf->head.num_room_in_leaf = new_room_in_leaf; new_leaf->num_stored_in_leaf = leaf->num_stored_in_leaf; -- Alan Modra Australia Development Lab, IBM