https://sourceware.org/bugzilla/show_bug.cgi?id=34317
Mark Wielaard <mark at klomp dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mark at klomp dot org
Status|UNCONFIRMED |RESOLVED
Resolution|--- |FIXED
--- Comment #4 from Mark Wielaard <mark at klomp dot org> ---
(In reply to Sujal Tuladhar from comment #0)
> Fix (attached as a git format-patch with Signed-off-by; also inline):
>
> - const unsigned char *lengths_end = lengths + section_count * 4;
> + /* The size table has one row of section_count 4-byte slots per unit,
> + just like the offset table, so it spans unit_count rows (not one).
> */
> + const unsigned char *lengths_end = (lengths +
> + unit_count * section_count * 4);
> ...
> + || ((unit_count != 0)
> + && (section_count > SIZE_MAX / (4 * (size_t) unit_count)))
>
Thanks, both fixes are obviously correct (after reading your comments).
Pushed your fix (adding a reference to this bug):
https://sourceware.org/cgit/elfutils/commit/?id=11f4264a7226e108d3e99073f2f469190a71eea4
And thanks for the POC to verify the issue.
--
You are receiving this mail because:
You are on the CC list for the bug.
