[obv] Fix alloca buffer overflow

Jan Kratochvil jan.kratochvil@redhat.com
Mon Apr 26 09:33:00 GMT 2010


Hi,

just saw it while reading around.  It is probably not exploitable and does not
seem to be even crashable at least on x86_64-gcc.


Regards,
Jan


http://sourceware.org/ml/gdb-cvs/2010-04/msg00250.html

--- src/gdb/ChangeLog	2010/04/24 13:12:49	1.11681
+++ src/gdb/ChangeLog	2010/04/26 09:30:03	1.11682
@@ -1,3 +1,8 @@
+2010-04-26  Jan Kratochvil  <jan.kratochvil@redhat.com>
+
+	* cp-namespace.c (cp_lookup_symbol_in_namespace): Fix alloca size.
+	Fix whitespace.
+
 2010-04-24  Pedro Alves  <pedro@codesourcery.com>
 
 	* defs.h: Adjust comment.
--- src/gdb/cp-namespace.c	2010/03/15 17:29:36	1.38
+++ src/gdb/cp-namespace.c	2010/04/26 09:30:10	1.39
@@ -264,12 +264,12 @@
   else
     {
       char *concatenated_name = alloca (strlen (namespace) + 2 +
-                                        strlen (name+ 1));
+                                        strlen (name) + 1);
       strcpy (concatenated_name, namespace);
       strcat (concatenated_name, "::");
       strcat (concatenated_name, name);
       return lookup_symbol_file (concatenated_name, block,
-				 domain,cp_is_anonymous (namespace));
+				 domain, cp_is_anonymous (namespace));
     }
 }
 



More information about the Gdb-patches mailing list