[Bug gdb/30641] AddressSanitizer: heap-buffer-overflow /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:284:10 in pe_as16(void*)

["simon.marchi at polymtl dot ca" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=30641

Simon Marchi <simon.marchi at polymtl dot ca> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |simon.marchi at polymtl dot ca

--- Comment #5 from Simon Marchi <simon.marchi at polymtl dot ca> ---
(In reply to Abdul Basit from comment #4)
> Regarding this issue and Bug 30640 there are CVEs linked to both issues.
> https://nvd.nist.gov/vuln/detail/CVE-2023-39129
> https://nvd.nist.gov/vuln/detail/CVE-2023-39130
> 
> @sihan2021 last comment on the ticket is following and afterwards there is
> no update: 
> > Please ignore 30639, 30640, and 30641 bug report. I will use the latest origin/master gdb with asan to check these bug again.
> 
> Can you please confirm is there any update regarding this as CVEs are still
> open for all these issues and there is no update on these two issues.   I do
> not see any new issue link to these CVEs.  So if these are not valid issues
> then it would be helpful to update the related CVEs otherwise if they are
> valid issues then to update them with right info about security issue in gdb
> 13.1
> 
> Thanks

They are likely valid issues.  If there is no update, it probably means nobody
has looked into fixing them.

-- 
You are receiving this mail because:
You are on the CC list for the bug.