PR24402, global buffer overflow in symtab_finalize

Message ID 20190401030454.GE18263@bubble.grove.modra.org
State New
Headers show
Series
  • PR24402, global buffer overflow in symtab_finalize
Related show

Commit Message

Alan Modra April 1, 2019, 3:04 a.m.
This bug goes back to git commit 5489fcc3d9d, Feb 1995.  Fixed by the
added dst[-1].name[0] check.

I also tweaked the initial prev_addr value since with an array of
symbols sorted by increasing addresses it seems like it may be
possible to wrongly match symbol addresses.  Not in real cases of
course, since a function calling _mcount must be more than one byte
long.

	PR 24402
	* symtab.c (symtab_finalize): Init prev_addr to one less than
	first symbol address, not one more.  Correct test for symbols
	with leading underscores.


-- 
Alan Modra
Australia Development Lab, IBM

Patch

diff --git a/gprof/symtab.c b/gprof/symtab.c
index 740168c703..70eb41573b 100644
--- a/gprof/symtab.c
+++ b/gprof/symtab.c
@@ -89,7 +89,7 @@  symtab_finalize (Sym_Table *tab)
 
   /* Remove duplicate entries to speed-up later processing and
      set end_addr if its not set yet.  */
-  prev_addr = tab->base[0].addr + 1;
+  prev_addr = tab->base[0].addr - 1;
 
   for (src = dst = tab->base; src < tab->limit; ++src)
     {
@@ -107,7 +107,7 @@  symtab_finalize (Sym_Table *tab)
 		  && ((src->is_func && !dst[-1].is_func)
 		      || ((src->is_func == dst[-1].is_func)
 			  && ((src->name[0] != '_' && dst[-1].name[0] == '_')
-			      || (src->name[0]
+			      || (src->name[0] == '_' && dst[-1].name[0] == '_'
 				  && src->name[1] != '_'
 				  && dst[-1].name[1] == '_'))))))
 	    {