[Bug binutils/20499] gprof: segmentation fault on invalid symbol file

[tobias at stoeckmann dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=20499

--- Comment #3 from Tobias Stoeckmann <tobias at stoeckmann dot org> ---
It is possible to access uninitialized memory now.

Take this symbol file for example:

x
x
x
a t a

The variable "name" is malloc()ed, so the content cannot be guaranteed to be
nul-terminated after first iteration (scanf fails, of course). The current
implementation would call strlen() on it anyway, so this might -- in very rare
occassions -- lead to another segmentation fault due to going past the malloc
boundaries.

-- 
You are receiving this mail because:
You are on the CC list for the bug.