public inbox for gdb-patches@sourceware.org
 help / color / mirror / Atom feed
From: Gary Benson <gbenson@redhat.com>
To: gdb-patches@sourceware.org
Subject: [PATCH] Fix buffer overrun found by Coverity
Date: Fri, 05 Oct 2018 13:53:00 -0000	[thread overview]
Message-ID: <1538747591-32283-1-git-send-email-gbenson@redhat.com> (raw)

Hi all,

This commit fixes a buffer overrun found by Coverity, where 36 bytes
are written into the 24 byte buffer "ids".  The "ids_seen" buffer
doesn't overrun, but I've changed that too, to future-proof it some.

I would have committed this as obvious, but the testsuite doesn't
exercise this piece of code; I can't realistically say I've regression
tested this change, so I'd like another pair of eyes on it to be sure.

Cheers,
Gary

--
gdb/ChangeLog:

	* dwarf2read.c (create_dwp_hash_table): Fix buffer overrun
	found by Coverity.
---
 gdb/ChangeLog    | 5 +++++
 gdb/dwarf2read.c | 5 +++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/gdb/dwarf2read.c b/gdb/dwarf2read.c
index 4a35e38..e9d1ac5 100644
--- a/gdb/dwarf2read.c
+++ b/gdb/dwarf2read.c
@@ -12197,6 +12197,7 @@ create_dwp_hash_table (struct dwarf2_per_objfile *dwarf2_per_objfile,
     {
       const gdb_byte *ids_ptr = htab->unit_table + sizeof (uint32_t) * nr_slots;
       int *ids = htab->section_pool.v2.section_ids;
+      size_t sizeof_ids = sizeof (htab->section_pool.v2.section_ids);
       /* Reverse map for error checking.  */
       int ids_seen[DW_SECT_MAX + 1];
       int i;
@@ -12213,8 +12214,8 @@ create_dwp_hash_table (struct dwarf2_per_objfile *dwarf2_per_objfile,
 		   " in section table [in module %s]"),
 		 dwp_file->name);
 	}
-      memset (ids, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
-      memset (ids_seen, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
+      memset (ids, 255, sizeof_ids);
+      memset (ids_seen, 255, sizeof (ids_seen));
       for (i = 0; i < nr_columns; ++i)
 	{
 	  int id = read_4_bytes (dbfd, ids_ptr + i * sizeof (uint32_t));
-- 
1.8.3.1

             reply	other threads:[~2018-10-05 13:53 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-05 13:53 Gary Benson [this message]
2018-10-05 14:18 ` Tom Tromey
2018-10-08 16:34   ` Gary Benson
2018-10-08 17:41     ` Tom Tromey
2018-10-09 13:25       ` Gary Benson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1538747591-32283-1-git-send-email-gbenson@redhat.com \
    --to=gbenson@redhat.com \
    --cc=gdb-patches@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).