https://sourceware.org/bugzilla/show_bug.cgi?id=32399
--- Comment #3 from Sourceware Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Alan Modra <amo...@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8ab91a033555c5faae1bcd615800670b91673731 commit 8ab91a033555c5faae1bcd615800670b91673731 Author: Alan Modra <amo...@gmail.com> Date: Sat Nov 30 16:41:14 2024 +1030 Re: PR32399, buffer overflow printing core_file_failing_command Fix more potential buffer overflows, and correct trad-code.c and cisco-core.c where they should be using bfd_{z}alloc rather than bfd_{z}malloc. To stop buffer overflows with fuzzed objects that don't have a terminator on the core_file_failing_command string, this patch allocates an extra byte at the end of the entire header buffer rather than poking a NUL at the end of the name array (u_comm[] or similar) because (a) it's better to not overwrite the file data, and (b) it is possible that some core files make use of fields in struct user beyond the end of u_comm to extend the command name. The patch also changes some unnecessary uses of bfd_zalloc to bfd_alloc. There's not much point in clearing memeory that will shortly be completely overwritten. PR 32399 * aix5ppc-core.c (xcoff64_core_p): Allocate an extra byte to ensure the core_file_failing_command string is terminated. * netbsd-core.c (netbsd_core_file_p): Likewise. * ptrace-core.c (ptrace_unix_core_file_p): Likewise. * rs6000-core.c (rs6000coff_core_p): Likewise. * trad-core.c (trad_unix_core_file_p): Likewise, and bfd_alloc tdata rather than bfd_zmalloc. * cisco-core.c (cisco_core_file_validate): bfd_zalloc tdata. -- You are receiving this mail because: You are on the CC list for the bug.
