Skip to content

Commit

Permalink
Fix #91, Redo SymbolNames malloc to remove out-of-bounds write
Browse files Browse the repository at this point in the history
  • Loading branch information
thnkslprpt committed Oct 28, 2022
1 parent 46b29f8 commit eef7cf8
Showing 1 changed file with 3 additions and 7 deletions.
10 changes: 3 additions & 7 deletions elf2cfetbl.c
Original file line number Diff line number Diff line change
Expand Up @@ -1882,7 +1882,6 @@ int32 GetSymbol(int32 SymbolIndex, union Elf_Sym *Symbol)
uint64_t calculated_offset = SymbolTableDataOffset + (SymbolIndex * SymbolTableEntrySize);
int32_t SeekOffset = (int32_t)calculated_offset;
char VerboseStr[60];
int32 i = 0;

memset(VerboseStr, 0, sizeof(VerboseStr));

Expand Down Expand Up @@ -1928,14 +1927,11 @@ int32 GetSymbol(int32 SymbolIndex, union Elf_Sym *Symbol)
printf(" st_name = 0x%08x - ", get_st_name(Symbol));
fseek(SrcFileDesc, SeekOffset, SEEK_SET);

while ((i < sizeof(VerboseStr)) && ((VerboseStr[i] = fgetc(SrcFileDesc)) != '\0'))
{
i++;
}
/* Ensure null terminated */
VerboseStr[sizeof(VerboseStr) - 1] = '\0';

VerboseStr[i] = '\0'; /* Just in case i=sizeof(VerboseStr) */
SymbolNames[SymbolIndex] = malloc(strlen(VerboseStr) + 1);

SymbolNames[SymbolIndex] = malloc(i + 1);
strcpy(SymbolNames[SymbolIndex], VerboseStr);

if ((strcmp(VerboseStr, TBL_DEF_SYMBOL_NAME) == 0) || (strcmp(&VerboseStr[1], TBL_DEF_SYMBOL_NAME) == 0))
Expand Down

0 comments on commit eef7cf8

Please sign in to comment.