diff options
| author | Luís Ferreira <contact@lsferreira.net> | 2021-09-23 11:33:47 -0400 |
|---|---|---|
| committer | Jeff Law <jeffreyalaw@gmail.com> | 2021-09-23 11:48:45 -0400 |
| commit | 5481040197402be6dfee265bd2ff5a4c88e30505 (patch) | |
| tree | 2aef05466c47a32ee95a2224af4787edc95702c5 /libiberty | |
| parent | libstdc++: Remove c++20-specific dg-error directives in test (diff) | |
| download | gcc-5481040197402be6dfee265bd2ff5a4c88e30505.tar.gz gcc-5481040197402be6dfee265bd2ff5a4c88e30505.tar.bz2 gcc-5481040197402be6dfee265bd2ff5a4c88e30505.tar.xz | |
libiberty: prevent buffer overflow when decoding user input
libiberty/
* d-demangle.c (dlang_symbol_backref): Ensure strlen of
string is less than length computed by dlang_number.
Diffstat (limited to 'libiberty')
| -rw-r--r-- | libiberty/d-demangle.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libiberty/d-demangle.c b/libiberty/d-demangle.c index a2152cc6551..7ded3e2a256 100644 --- a/libiberty/d-demangle.c +++ b/libiberty/d-demangle.c | |||
| @@ -381,7 +381,7 @@ dlang_symbol_backref (string *decl, const char *mangled, | |||
| 381 | 381 | ||
| 382 | /* Must point to a simple identifier. */ | 382 | /* Must point to a simple identifier. */ |
| 383 | backref = dlang_number (backref, &len); | 383 | backref = dlang_number (backref, &len); |
| 384 | if (backref == NULL) | 384 | if (backref == NULL || strlen(backref) < len) |
| 385 | return NULL; | 385 | return NULL; |
| 386 | 386 | ||
| 387 | backref = dlang_lname (decl, backref, len); | 387 | backref = dlang_lname (decl, backref, len); |