Hi mustafa,
On Tue, Nov 3, 2026 at 2:28 AM mustafa <[email protected]> wrote:
>
> handle_core_item used alloca (*repeated_size) and a variable length
> array sized from the set bits to print 'b' and 'B' items. Both sizes
> come from the note in the core file, so a large note overflows the
> stack.
>
> Use xmalloc and free through a cleanup attribute.
>
> Signed-off-by: mohammed mustafa <[email protected]>
> ---
> src/readelf.c | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/src/readelf.c b/src/readelf.c
> index 0f13874f..ba47f361 100644
> --- a/src/readelf.c
> +++ b/src/readelf.c
> @@ -11847,6 +11847,12 @@ convert (Elf *core, Elf_Type type, uint_fast16_t
> count,
>
> typedef uint8_t GElf_Byte;
>
> +static void
> +free_ptr (void *p)
> +{
> + free (*(void **) p);
> +}
> +
> static unsigned int
> handle_core_item (Elf *core, const Ebl_Core_Item *item, const void *desc,
> unsigned int colno, size_t *repeated_size)
> @@ -11874,13 +11880,15 @@ handle_core_item (Elf *core, const
> Ebl_Core_Item *item, const void *desc,
> TYPES;
> #undef DO_TYPE
>
> + void *heap_data __attribute__ ((cleanup (free_ptr))) = NULL;
> size_t size = gelf_fsize (core, item->type, count, EV_CURRENT);
> size_t convsize = size;
> if (repeated_size != NULL)
> {
> if (*repeated_size > size && (item->format == 'b' ||
> item->format == 'B'))
> {
> - data = alloca (*repeated_size);
> + heap_data = xmalloc (*repeated_size);
> + data = heap_data;
This patch appears to have been made on top an older commit. Commit
22437a8e caps the max size of the stack allocation. Replacing alloca
with xmalloc is reasonable but please rebase onto the current main and
preserve the existing cap.
> count *= *repeated_size / size;
> convsize = count * size;
> *repeated_size -= convsize;
> @@ -11940,7 +11948,8 @@ handle_core_item (Elf *core, const
> Ebl_Core_Item *item, const void *desc,
> const unsigned int bias = item->format == 'b';
>
> {
> - char printed[(negate ? nbits - pop : pop) * 16 + 1];
> + char *printed __attribute__ ((cleanup (free_ptr)))
> + = xmalloc ((negate ? nbits - pop : pop) * 16 + 1);
Please avoid the cleanup attribute as I described in a previous review.
Aaron
> char *p = printed;
> *p = '\0';
>
> --
> 2.53.0
>
