[committed] Fix dynamic-stack-buffer-overflow (write_dso, distance)

[committed] Fix dynamic-stack-buffer-overflow (write_dso, distance)

[Tom de Vries]

Hi,

When compiling with gcc 8 and -fsanitize=address -lasan, we run into a
dynamic-stack-buffer-overflow related to the distance variable in write_dso.

The variable is allocated with dimension dso->ehdr.e_shnum, but we use
dso->ehdr.e_shnum elements while not using element 0.

Fix this by increasing the size of the distance variable.

This fixes the dwz-fedora-s390x buildbot failure.

Committed to trunk.

Thanks,
- Tom

Fix dynamic-stack-buffer-overflow (write_dso, distance)

2019-06-27  Tom de Vries  <tdevries@suse.de>

	PR dwz/24734
	* dwz.c (write_dso): Increase size of distance.

---
 dwz.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dwz.c b/dwz.c
index a73fe38..4e14086 100644
--- a/dwz.c
+++ b/dwz.c
@@ -10549,7 +10549,7 @@ write_dso (DSO *dso, const char *file, struct stat *st)
   GElf_Word shstrtabadd = 0;
   char *shstrtab = NULL;
   bool remove_sections[SECTION_COUNT];
-  GElf_Off distance[dso->ehdr.e_shnum];
+  GElf_Off distance[dso->ehdr.e_shnum + 1];
   /* Array of sections and section header table sorted by file offset.  */
   unsigned int sorted_section_numbers[dso->ehdr.e_shnum + 1];