[PATCH 1/1] gdb: Fix segfault with a negative .dynamic section size

[Felix Willgerodt <felix.willgerodt@intel.com>]

Consider a binary with an erroneous size of the .dynamic section:

$ readelf a.out
...
  [24] .dynamic          DYNAMIC          0000000000004c20  00003c20
       000000fffffffa40  0000000000000010  WA       7     0     8
...

This binary causes a segfault in GDB, because we pass a negative
value to alloca in gdb_bfd_scan_elf_dyntag.  Alloca accepts size_t though,
so it is really a big size that we pass.  I changed the code to heap
allocation, as the size of the .dynamic section could be "too big" in a
correct binary as well.  That way GDB will assert on a negative size value.

There should be no user visible change after this.
---
 gdb/solib.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gdb/solib.c b/gdb/solib.c
index b9fb911a810..45a5309d199 100644
--- a/gdb/solib.c
+++ b/gdb/solib.c
@@ -1546,7 +1546,8 @@ gdb_bfd_scan_elf_dyntag (const int desired_dyntag, bfd *abfd, CORE_ADDR *ptr,
   /* Read in .dynamic from the BFD.  We will get the actual value
      from memory later.  */
   sect_size = bfd_section_size (sect);
-  buf = bufstart = (gdb_byte *) alloca (sect_size);
+  gdb::byte_vector buffer (sect_size);
+  buf = bufstart = buffer.data ();
   if (!bfd_get_section_contents (abfd, sect,
 				 buf, 0, sect_size))
     return 0;
-- 
2.34.1

Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de <http://www.intel.de>
Managing Directors: Christin Eisenschmid, Sharon Heck, Tiffany Doon Silva  
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928