From ea5ff9fa6b2b093e51f00ba3274276f9877ea616 Mon Sep 17 00:00:00 2001 From: Bob Haarman Date: Mon, 18 Dec 2017 22:10:14 +0000 Subject: Fix buffer overrun in WindowsResourceCOFFWriter::writeSymbolTable() Summary: We were using sprintf(..., "$R06X", ) to create strings that are expected to be exactly length 8, but this results in longer strings if the uint32_t is greater than 0xffffff. This change modifies the behavior as follows: - Uses the loop counter instead of the data offset. This gives us sequential symbol names, avoiding collisions as much as possible. - Masks the value to 0xffffff to avoid generating names longer than 8 bytes. - Uses formatv instead of sprintf. Fixes PR35581. Reviewers: ruiu, zturner Reviewed By: ruiu Subscribers: hiraditya, llvm-commits Differential Revision: https://reviews.llvm.org/D41270 llvm-svn: 321030 --- llvm/lib/Object/WindowsResource.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'llvm/lib/Object/WindowsResource.cpp') diff --git a/llvm/lib/Object/WindowsResource.cpp b/llvm/lib/Object/WindowsResource.cpp index 9ca584a4a1a..271224ec631 100644 --- a/llvm/lib/Object/WindowsResource.cpp +++ b/llvm/lib/Object/WindowsResource.cpp @@ -14,6 +14,7 @@ #include "llvm/Object/WindowsResource.h" #include "llvm/Object/COFF.h" #include "llvm/Support/FileOutputBuffer.h" +#include "llvm/Support/FormatVariadic.h" #include "llvm/Support/MathExtras.h" #include #include @@ -560,10 +561,9 @@ void WindowsResourceCOFFWriter::writeSymbolTable() { // Now write a symbol for each relocation. for (unsigned i = 0; i < Data.size(); i++) { - char RelocationName[9]; - sprintf(RelocationName, "$R%06X", DataOffsets[i]); + auto RelocationName = formatv("$R{0:X-6}", i & 0xffffff).sstr(); Symbol = reinterpret_cast(BufferStart + CurrentOffset); - strncpy(Symbol->Name.ShortName, RelocationName, (size_t)COFF::NameSize); + memcpy(Symbol->Name.ShortName, RelocationName.data(), (size_t) COFF::NameSize); Symbol->Value = DataOffsets[i]; Symbol->SectionNumber = 2; Symbol->Type = COFF::IMAGE_SYM_DTYPE_NULL; -- cgit v1.2.3