From 1da441c1b020bef75d040dd300814b1a49e0e529 Mon Sep 17 00:00:00 2001 From: Ian Lance Taylor Date: Wed, 2 Dec 2020 11:06:40 -0800 Subject: [PATCH] libbacktrace: correct buffer overflow tests * dwarf.c (resolve_string): Use > rather than >= to check whether string index extends past buffer. (resolve_addr_index): Similarly for address index. --- dwarf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dwarf.c b/dwarf.c index a4d8913..8ae28e8 100644 --- a/dwarf.c +++ b/dwarf.c @@ -1386,7 +1386,7 @@ resolve_string (const struct dwarf_sections *dwarf_sections, int is_dwarf64, offset = val->u.uint * (is_dwarf64 ? 8 : 4) + str_offsets_base; if (offset + (is_dwarf64 ? 8 : 4) - >= dwarf_sections->size[DEBUG_STR_OFFSETS]) + > dwarf_sections->size[DEBUG_STR_OFFSETS]) { error_callback (data, "DW_FORM_strx value out of range", 0); return 0; @@ -1430,7 +1430,7 @@ resolve_addr_index (const struct dwarf_sections *dwarf_sections, struct dwarf_buf addr_buf; offset = addr_index * addrsize + addr_base; - if (offset + addrsize >= dwarf_sections->size[DEBUG_ADDR]) + if (offset + addrsize > dwarf_sections->size[DEBUG_ADDR]) { error_callback (data, "DW_FORM_addrx value out of range", 0); return 0;