1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
From: Alan Modra <amodra@gmail.com>
Date: Wed, 21 Dec 2022 11:10:12 +0000 (+1030)
Subject: PR29925, Memory leak in find_abstract_instance
X-Git-Tag: binutils-2_40~192
X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d28fbc7197ba0e021a43f873eff90b05dcdcff6a
PR29925, Memory leak in find_abstract_instance
The testcase in the PR had a variable with both DW_AT_decl_file and
DW_AT_specification, where the DW_AT_specification also specified
DW_AT_decl_file. This leads to a memory leak as the file name is
malloced and duplicates are not expected.
I've also changed find_abstract_instance to not use a temp for "name",
because that can result in a change in behaviour from the usual last
of duplicate attributes wins.
PR 29925
* dwarf2.c (find_abstract_instance): Delete "name" variable.
Free *filename_ptr before assigning new file name.
(scan_unit_for_symbols): Similarly free func->file and
var->file before assigning.
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d28fbc7197ba0e021a43f873eff90b05dcdcff6a]
CVE: CVE-2022-48065
Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com>
---
diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
index 0cd8152ee6e..b608afbc0cf 100644
--- a/bfd/dwarf2.c
+++ b/bfd/dwarf2.c
@@ -3441,7 +3441,6 @@ find_abstract_instance (struct comp_unit *unit,
struct abbrev_info *abbrev;
uint64_t die_ref = attr_ptr->u.val;
struct attribute attr;
- const char *name = NULL;
if (recur_count == 100)
{
@@ -3602,9 +3601,9 @@ find_abstract_instance (struct comp_unit *unit,
case DW_AT_name:
/* Prefer DW_AT_MIPS_linkage_name or DW_AT_linkage_name
over DW_AT_name. */
- if (name == NULL && is_str_form (&attr))
+ if (*pname == NULL && is_str_form (&attr))
{
- name = attr.u.str;
+ *pname = attr.u.str;
if (mangle_style (unit->lang) == 0)
*is_linkage = true;
}
@@ -3612,7 +3611,7 @@ find_abstract_instance (struct comp_unit *unit,
case DW_AT_specification:
if (is_int_form (&attr)
&& !find_abstract_instance (unit, &attr, recur_count + 1,
- &name, is_linkage,
+ pname, is_linkage,
filename_ptr, linenumber_ptr))
return false;
break;
@@ -3622,7 +3621,7 @@ find_abstract_instance (struct comp_unit *unit,
non-string forms into these attributes. */
if (is_str_form (&attr))
{
- name = attr.u.str;
+ *pname = attr.u.str;
*is_linkage = true;
}
break;
@@ -3630,8 +3629,11 @@ find_abstract_instance (struct comp_unit *unit,
if (!comp_unit_maybe_decode_line_info (unit))
return false;
if (is_int_form (&attr))
- *filename_ptr = concat_filename (unit->line_table,
- attr.u.val);
+ {
+ free (*filename_ptr);
+ *filename_ptr = concat_filename (unit->line_table,
+ attr.u.val);
+ }
break;
case DW_AT_decl_line:
if (is_int_form (&attr))
@@ -3643,7 +3645,6 @@ find_abstract_instance (struct comp_unit *unit,
}
}
}
- *pname = name;
return true;
}
@@ -4139,8 +4140,11 @@ scan_unit_for_symbols (struct comp_unit *unit)
case DW_AT_decl_file:
if (is_int_form (&attr))
- func->file = concat_filename (unit->line_table,
- attr.u.val);
+ {
+ free (func->file);
+ func->file = concat_filename (unit->line_table,
+ attr.u.val);
+ }
break;
case DW_AT_decl_line:
@@ -4182,8 +4186,11 @@ scan_unit_for_symbols (struct comp_unit *unit)
case DW_AT_decl_file:
if (is_int_form (&attr))
- var->file = concat_filename (unit->line_table,
- attr.u.val);
+ {
+ free (var->file);
+ var->file = concat_filename (unit->line_table,
+ attr.u.val);
+ }
break;
case DW_AT_decl_line:
|
