[Bug libsframe/34417] OOB access in libsframe sframe_decode_fre(): datawords_sz is copied into the 24-byte fre_datawords[] with the size check performed only after the memcpy. A crafted .sframe section triggers a buffer overflow via readelf/objdump (stack) and via ld (heap)

[ibhagatgnu at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=34417

Indu Bhagat <ibhagatgnu at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |ibhagatgnu at gmail dot 
com
                 CC|                            |ibhagatgnu at gmail dot com
          Component|binutils                    |libsframe

-- 
You are receiving this mail because:
You are on the CC list for the bug.