handle_core_item used alloca for a buffer sized from the core note and a variable length array sized from the set bits to print 'b' and 'B' items. Both sizes come from the note in the core file, so a large note can overflow the stack.
Use xmalloc for these buffers and free them explicitly. Signed-off-by: Mohammed Mustafa <[email protected]> --- v2: - Rebased onto current main and preserved the 64 KiB allocation cap. - Avoided the cleanup attribute and free allocations explicitly. src/readelf.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/readelf.c b/src/readelf.c index <current-main>..<v2> 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -11867,6 +11867,7 @@ handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, #define DO_TYPE(NAME, Name, hex, dec) GElf_##Name Name typedef union { TYPES; } value_t; void *data = alloca (count * sizeof (value_t)); + void *heap_data = NULL; #undef DO_TYPE @@ -11882,7 +11883,8 @@ handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, { size_t alloc_size = MIN (*repeated_size, 64 * 1024); - data = alloca (alloc_size); + heap_data = xmalloc (alloc_size); + data = heap_data; count *= alloc_size / size; convsize = count * size; *repeated_size -= convsize; @@ -11940,7 +11942,7 @@ handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, const unsigned int bias = item->format == 'b'; { - char printed[(negate ? nbits - pop : pop) * 16 + 1]; + char *printed = xmalloc ((negate ? nbits - pop : pop) * 16 + 1); char *p = printed; *p = '\0'; @@ -11998,6 +12000,7 @@ handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, colno = print_core_item (colno, ',', WRAP_COLUMN, 0, item->name, negate ? "~<%s>" : "<%s>", printed); + free (printed); } break; @@ -12087,6 +12090,7 @@ handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, #undef TYPES + free (heap_data); return colno; } -- 2.53.0
