From: Alan Modra <amodra@gmail.com>
Date: Sun, 5 Jul 2020 23:30:29 +0000 (+0930)
Subject: asan: readelf: stack buffer overflow
X-Git-Url: https://git.efficios.com/?a=commitdiff_plain;h=ddb43bab174c50656331e5460b18bd8e8be5f522;p=deliverable%2Fbinutils-gdb.git

asan: readelf: stack buffer overflow

	* readelf.c (print_dynamic_symbol): Don't sprintf to buffer to
	find string length.
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index ecb29c5674..d957af5f1c 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2020-07-06  Alan Modra  <amodra@gmail.com>
+
+	* readelf.c (print_dynamic_symbol): Don't sprintf to buffer to
+	find string length.
+
 2020-07-04  Nick Clifton  <nickc@redhat.com>
 
 	* configure: Regenerate.
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 6057515a89..41547a2594 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -12091,9 +12091,9 @@ print_dynamic_symbol (Filedata *filedata, unsigned long si,
   int len_avail = 21;
   if (! do_wide && version_string != NULL)
     {
-      char buffer[256];
+      char buffer[16];
 
-      len_avail -= sprintf (buffer, "@%s", version_string);
+      len_avail -= 1 + strlen (version_string);
 
       if (sym_info == symbol_undefined)
 	len_avail -= sprintf (buffer," (%d)", vna_other);