Skip to content

Commit d1c5a3c

Browse files
Nick CliftonH. Peter Anvin
authored andcommitted
outobj: fix buffer overflow when too many segments in a group
The number of entries in a group was hard-coded, but not enforced. Reported-by: <BreakingBad6@github.com> Fixes: #203 Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
1 parent 4a56d66 commit d1c5a3c

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

output/outobj.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1736,6 +1736,10 @@ obj_directive(enum directive directive, char *value)
17361736
*/
17371737
continue;
17381738
}
1739+
if (grp->nentries >= GROUP_MAX) {
1740+
nasm_nonfatal("too many segments in a group");
1741+
return DIRR_ERROR;
1742+
}
17391743
for (seg = seghead; seg; seg = seg->next)
17401744
if (!strcmp(seg->name, p))
17411745
break;

0 commit comments

Comments
 (0)