This is the mail archive of the binutils@sourceware.org mailing list for the binutils project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: eh-frame: CIE initial_instructions overflow

Hi Christophe,


Currently, in bfd/elf-eh-frame.c we have a definition of struct cie
which ends with:
   unsigned char initial_instructions[50];


This is a bug...


In _bfd_elf_parse_eh_frame(), we have:
       initial_insn_length = end - buf;
       if (initial_insn_length <= sizeof (cie->initial_instructions))
         {
           cie->initial_insn_length = initial_insn_length;
           memcpy (cie->initial_instructions, buf, initial_insn_length);
         }
IMHO - there should be no fixed size for the initial_instructions buffer. Instead the code at this point should allocate and copy the buffer that has just been created. 

Cheers
  Nick
Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]