[PATCH] D41270: Fix buffer overrun in WindowsResourceCOFFWriter::writeSymbolTable()

[Bob Haarman via Phabricator via llvm-commits]

inglorion updated this revision to Diff 127403.
inglorion edited the summary of this revision.
inglorion removed a reviewer: pcc.
inglorion added a comment.

Rewrote using formatv and using loop counter instead of offset.


https://reviews.llvm.org/D41270

Files:
  llvm/lib/Object/WindowsResource.cpp


Index: llvm/lib/Object/WindowsResource.cpp
===================================================================
--- llvm/lib/Object/WindowsResource.cpp
+++ llvm/lib/Object/WindowsResource.cpp
@@ -14,6 +14,7 @@
 #include "llvm/Object/WindowsResource.h"
 #include "llvm/Object/COFF.h"
 #include "llvm/Support/FileOutputBuffer.h"
+#include "llvm/Support/FormatVariadic.h"
 #include "llvm/Support/MathExtras.h"
 #include <ctime>
 #include <queue>
@@ -560,10 +561,9 @@
 
   // Now write a symbol for each relocation.
   for (unsigned i = 0; i < Data.size(); i++) {
-    char RelocationName[9];
-    sprintf(RelocationName, "$R%06X", DataOffsets[i]);
+    auto RelocationName = formatv("$R{0:X6}", i & 0xffffff).sstr<COFF::NameSize>();
     Symbol = reinterpret_cast<coff_symbol16 *>(BufferStart + CurrentOffset);
-    strncpy(Symbol->Name.ShortName, RelocationName, (size_t)COFF::NameSize);
+    memcpy(Symbol->Name.ShortName, RelocationName.data(), (size_t) COFF::NameSize);
     Symbol->Value = DataOffsets[i];
     Symbol->SectionNumber = 2;
     Symbol->Type = COFF::IMAGE_SYM_DTYPE_NULL;


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D41270.127403.patch
Type: text/x-patch
Size: 1087 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20171218/6c91fca9/attachment.bin>