handle_core_item used alloca (*repeated_size) and a variable length array sized from the set bits to print 'b' and 'B' items. Both sizes come from the note in the core file, so a large note overflows the stack.
Use xmalloc and free through a cleanup attribute. Signed-off-by: mohammed mustafa <[email protected]> --- src/readelf.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/readelf.c b/src/readelf.c index 0f13874f..ba47f361 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -11847,6 +11847,12 @@ convert (Elf *core, Elf_Type type, uint_fast16_t count, typedef uint8_t GElf_Byte; +static void +free_ptr (void *p) +{ + free (*(void **) p); +} + static unsigned int handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, unsigned int colno, size_t *repeated_size) @@ -11874,13 +11880,15 @@ handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, TYPES; #undef DO_TYPE + void *heap_data __attribute__ ((cleanup (free_ptr))) = NULL; size_t size = gelf_fsize (core, item->type, count, EV_CURRENT); size_t convsize = size; if (repeated_size != NULL) { if (*repeated_size > size && (item->format == 'b' || item->format == 'B')) { - data = alloca (*repeated_size); + heap_data = xmalloc (*repeated_size); + data = heap_data; count *= *repeated_size / size; convsize = count * size; *repeated_size -= convsize; @@ -11940,7 +11948,8 @@ handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc, const unsigned int bias = item->format == 'b'; { - char printed[(negate ? nbits - pop : pop) * 16 + 1]; + char *printed __attribute__ ((cleanup (free_ptr))) + = xmalloc ((negate ? nbits - pop : pop) * 16 + 1); char *p = printed; *p = '\0'; -- 2.53.0
