diff options
| author | Luís Ferreira <contact@lsferreira.net> | 2021-09-23 11:33:47 -0400 |
|---|---|---|
| committer | Jeff Law <jeffreyalaw@gmail.com> | 2021-09-23 11:48:45 -0400 |
| commit | 5481040197402be6dfee265bd2ff5a4c88e30505 (patch) | |
| tree | 2aef05466c47a32ee95a2224af4787edc95702c5 /libiberty | |
| parent | 43358e91bd1d2b376ce8f426cf9becedf8343a06 (diff) | |
libiberty: prevent buffer overflow when decoding user input
libiberty/
* d-demangle.c (dlang_symbol_backref): Ensure strlen of
string is less than length computed by dlang_number.
Diffstat (limited to 'libiberty')
| -rw-r--r-- | libiberty/d-demangle.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libiberty/d-demangle.c b/libiberty/d-demangle.c index a2152cc6551..7ded3e2a256 100644 --- a/libiberty/d-demangle.c +++ b/libiberty/d-demangle.c @@ -381,7 +381,7 @@ dlang_symbol_backref (string *decl, const char *mangled, /* Must point to a simple identifier. */ backref = dlang_number (backref, &len); - if (backref == NULL) + if (backref == NULL || strlen(backref) < len) return NULL; backref = dlang_lname (decl, backref, len); |