[Bug binutils/34417] OOB access in libsframe sframe_decode_fre(): datawords_sz is copied into the 24-byte fre_datawords[] with the size check performed only after the memcpy. A crafted .sframe section triggers a buffer overflow via readelf/objdump (stack) and via ld (heap)

[achintya at umail dot ucsb.edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=34417

--- Comment #1 from Achintya <achintya at umail dot ucsb.edu> ---
This bug also contributes to heap disclosure:
The encoded size can also be destination-safe, e.g., 24 bytes, while the FRE
itself is positioned near the end of the allocated FRE subsection. In that case
the memcpy reads past the SFrame allocation into adjacent heap memory.
Objdump's SFrame dump routines then format selected over-read words as frame
recovery data, leaking heap address material.

-- 
You are receiving this mail because:
You are on the CC list for the bug.