PR24911, Heap overflow issue in qsort_r, dwarf.c

The actual args to this function are "pointers to pointers to
debug_info".

	PR 24911
	* dwarf.c (comp_addr_base): Dereference args.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index cf8eea7fca2fdd2a391d1655974c8a082f75240e..7605a4039567a5f63b12c840fc32c86277179b4d 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2019-08-17  Alan Modra  <amodra@gmail.com>
+
+       PR 24911
+       * dwarf.c (comp_addr_base): Dereference args.
+
 2019-08-16  Alan Modra  <amodra@gmail.com>
 
        PR 24909

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index d63383271b724cba483a7f63bb103030807b75a0..b4738ebb8d3c9ce41456c78b4661732120189b01 100644 (file)
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -6545,8 +6545,8 @@ display_debug_aranges (struct dwarf_section *section,
 static int
 comp_addr_base (const void * v0, const void * v1)
 {
-  debug_info * info0 = (debug_info *) v0;
-  debug_info * info1 = (debug_info *) v1;
+  debug_info *info0 = *(debug_info **) v0;
+  debug_info *info1 = *(debug_info **) v1;
   return info0->addr_base - info1->addr_base;
 }