mischief/openbsd-src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2025-01-10 06:47:55 -08:00
Code

Fix a buffer over-read while dumping functions.

Browse Source 
A bogus vlen in metadata could cause offset point beyond CTF section
boundary. Found by afl-fuzz.

Ok mpi@
This commit is contained in:
sunil 2019-03-16 16:35:03 +00:00
parent 9bcbe5a4c7
commit 7b3efaaaec
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
usr.bin/ctfdump/ctfdump.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ctfdump.c,v 1.21 2019/03/16 15:34:58 sunil Exp $ */
/* $OpenBSD: ctfdump.c,v 1.22 2019/03/16 16:35:03 sunil Exp $ */
/*
* Copyright (c) 2016 Martin Pieuchot <mpi@openbsd.org>
@ -476,6 +476,9 @@ ctf_dump_type(struct ctf_header *cth, const char *data, off_t dlen,
printf(" returns: %u args: (%u", ctt->ctt_type, *argp);
for (i = 1; i < vlen; i++) {
argp++;
if ((const char *)argp > data + dlen)
errx(1, "offset exceeds CTF section");
printf(", %u", *argp);
}
printf(")");