https://sourceware.org/bugzilla/show_bug.cgi?id=34417
Indu Bhagat <ibhagatgnu at gmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|OOB access in libsframe |OOB access in libsframe
|sframe_decode_fre(): |sframe_decode_fre
|datawords_sz is copied into |
|the 24-byte fre_datawords[] |
|with the size check |
|performed only after the |
|memcpy. A crafted .sframe |
|section triggers a buffer |
|overflow via |
|readelf/objdump (stack) and |
|via ld (heap) |
--- Comment #2 from Indu Bhagat <ibhagatgnu at gmail dot com> ---
Renamed the bug from:
"OOB access in libsframe sframe_decode_fre(): datawords_sz is copied into the
24-byte fre_datawords[] with the size check performed only after the memcpy. A
crafted .sframe section triggers a buffer overflow via readelf/objdump (stack)
and via ld (heap)"
to
"OOB access in libsframe sframe_decode_fre"
--
You are receiving this mail because:
You are on the CC list for the bug.
