Fix buffer overrun found by Coverity

This commit fixes a buffer overrun found by Coverity, where
36 bytes are written into a 24 byte buffer.

gdb/ChangeLog:

	* dwarf2read.c (create_dwp_hash_table): Fix buffer overrun
	found by Coverity.

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index e8deee899ed270c52f208d5160d3b750cf199a94..f37070ea4841fe00a6d0c0e873bf83278d260a4f 100644 (file)
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,8 @@
+2018-10-09  Gary Benson <gbenson@redhat.com>
+
+       * dwarf2read.c (create_dwp_hash_table): Fix buffer overrun
+       found by Coverity.
+
 2018-10-08  Tom Tromey  <tom@tromey.com>
 
        * riscv-fbsd-tdep.c (riscv_fbsd_sigframe_init): Remove unused

diff --git a/gdb/dwarf2read.c b/gdb/dwarf2read.c
index c952996f4dea5032188415f67226cc2f098c8a8a..2a1b805c9a7d84e0b8fe5c4ffd8b507b7f1fbb92 100644 (file)
--- a/gdb/dwarf2read.c
+++ b/gdb/dwarf2read.c
@@ -12196,6 +12196,7 @@ create_dwp_hash_table (struct dwarf2_per_objfile *dwarf2_per_objfile,
     {
       const gdb_byte *ids_ptr = htab->unit_table + sizeof (uint32_t) * nr_slots;
       int *ids = htab->section_pool.v2.section_ids;
+      size_t sizeof_ids = sizeof (htab->section_pool.v2.section_ids);
       /* Reverse map for error checking.  */
       int ids_seen[DW_SECT_MAX + 1];
       int i;
@@ -12212,8 +12213,8 @@ create_dwp_hash_table (struct dwarf2_per_objfile *dwarf2_per_objfile,
                   " in section table [in module %s]"),
                 dwp_file->name);
        }
-      memset (ids, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
-      memset (ids_seen, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
+      memset (ids, 255, sizeof_ids);
+      memset (ids_seen, 255, sizeof (ids_seen));
       for (i = 0; i < nr_columns; ++i)
        {
          int id = read_4_bytes (dbfd, ids_ptr + i * sizeof (uint32_t));