libdwfl: Fix possible unbounded stack usage in cache_sections.
For modules with lots of sections cache_sections could blow up the stack
theoretically. Don't use alloca, but use malloc with explicit free.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
diff --git a/libdwfl/derelocate.c b/libdwfl/derelocate.c
index da67908..2889fe4 100644
--- a/libdwfl/derelocate.c
+++ b/libdwfl/derelocate.c
@@ -1,5 +1,5 @@
/* Recover relocatibility for addresses computed from debug information.
- Copyright (C) 2005-2010, 2013 Red Hat, Inc.
+ Copyright (C) 2005-2010, 2013, 2015 Red Hat, Inc.
This file is part of elfutils.
This file is free software; you can redistribute it and/or modify
@@ -80,7 +80,8 @@
{
elf_error:
__libdwfl_seterrno (DWFL_E_LIBELF);
- return -1;
+ nrefs = -1;
+ goto free_refs;
}
bool check_reloc_sections = false;
@@ -112,7 +113,15 @@
if (unlikely (name == NULL))
goto elf_error;
- struct secref *newref = alloca (sizeof *newref);
+ struct secref *newref = malloc (sizeof *newref);
+ if (unlikely (newref == NULL))
+ {
+ nomem:
+ __libdwfl_seterrno (DWFL_E_NOMEM);
+ nrefs = -1;
+ goto free_refs;
+ }
+
newref->scn = scn;
newref->relocs = NULL;
newref->name = name;
@@ -147,13 +156,13 @@
}
mod->reloc_info = malloc (offsetof (struct dwfl_relocation, refs[nrefs]));
- if (mod->reloc_info == NULL)
- {
- __libdwfl_seterrno (DWFL_E_NOMEM);
- return -1;
- }
+ if (unlikely (mod->reloc_info == NULL))
+ goto nomem;
- struct secref **sortrefs = alloca (nrefs * sizeof sortrefs[0]);
+ struct secref **sortrefs = malloc (nrefs * sizeof sortrefs[0]);
+ if (unlikely (sortrefs == NULL))
+ goto nomem;
+
for (size_t i = nrefs; i-- > 0; refs = refs->next)
sortrefs[i] = refs;
assert (refs == NULL);
@@ -170,6 +179,8 @@
mod->reloc_info->refs[i].end = sortrefs[i]->end;
}
+ free (sortrefs);
+
if (unlikely (check_reloc_sections))
{
/* There was a reloc section that preceded its target section.
@@ -199,6 +210,14 @@
}
}
+free_refs:
+ while (refs != NULL)
+ {
+ struct secref *ref = refs;
+ refs = ref->next;
+ free (ref);
+ }
+
return nrefs;
}