There was a typo in the __libdw_read_offset call that meant it only
checked there were 3 bytes available in .debug_info at the given
offset instead of 4. This could result in a 1 byte overread.
* libdw/dwarf_getpubnames.c (get_offsets): Call
__libdw_read_offset with size 4.
https://sourceware.org/bugzilla/show_bug.cgi?id=34392
Reported-by: Karan Kurani <[email protected]>
Signed-off-by: Mark Wielaard <[email protected]>
---
libdw/dwarf_getpubnames.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libdw/dwarf_getpubnames.c b/libdw/dwarf_getpubnames.c
index de726407c079..94e624b27ed4 100644
--- a/libdw/dwarf_getpubnames.c
+++ b/libdw/dwarf_getpubnames.c
@@ -105,7 +105,7 @@ get_offsets (Dwarf *dbg)
/* Get the CU offset. */
if (__libdw_read_offset (dbg, dbg, IDX_debug_pubnames,
readp + 2, len_bytes,
- &mem[cnt].cu_offset, IDX_debug_info, 3))
+ &mem[cnt].cu_offset, IDX_debug_info, 4))
/* Error has been already set in reader. */
goto err_return;
--
2.55.0
