[PATCH][libiberty] Fix read buffer overflow in split_directories()

[Tim Rühsen]

On 10.11.19 05:51, Orlando Arias wrote:
> Greetings
> 
> On 11/9/19 6:18 PM, Tim Rühsen wrote:
>> In line
>>   if (dirs[num_dirs - 1] == NULL)
>> 'num_dirs' can be 0.
>>
>> Regards, Tim
>>
> 
> I've looked at the control-flow on this file and I do not see a possible
> path for num_dirs to be 0 at line 186, unless the file name in question
> is the empty string "", at which point it may just be easier to return
> earlier. Can you please verify this?

Yes, I can confirm. Thanks for review !

Returning early on an empty 'name' also fixes another read overflow in

#ifdef HAVE_DOS_BASED_FILE_SYSTEM
  if (name[1] == ':' && IS_DIR_SEPARATOR (name[2]))
    {
      p += 3;
      num_dirs++;
    }
#endif /* HAVE_DOS_BASED_FILE_SYSTEM */

Patch v2 appended.

Regards, Tim
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-libiberty-Fix-read-buffer-overflow-in-split_director.patch
Type: text/x-patch
Size: 869 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20191110/75cccf18/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://sourceware.org/pipermail/binutils/attachments/20191110/75cccf18/attachment.sig>