{"action":"opened","issue":{"url":"https://api.github.com/repos/elfmaster/ecfs/issues/15","labels_url":"https://api.github.com/repos/elfmaster/ecfs/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/elfmaster/ecfs/issues/15/comments","events_url":"https://api.github.com/repos/elfmaster/ecfs/issues/15/events","html_url":"https://github.com/elfmaster/ecfs/issues/15","id":114158097,"number":15,"title":"heap buffer overflow","user":{"login":"elfmaster","id":5854752,"avatar_url":"https://avatars.githubusercontent.com/u/5854752?v=3","gravatar_id":"","url":"https://api.github.com/users/elfmaster","html_url":"https://github.com/elfmaster","followers_url":"https://api.github.com/users/elfmaster/followers","following_url":"https://api.github.com/users/elfmaster/following{/other_user}","gists_url":"https://api.github.com/users/elfmaster/gists{/gist_id}","starred_url":"https://api.github.com/users/elfmaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elfmaster/subscriptions","organizations_url":"https://api.github.com/users/elfmaster/orgs","repos_url":"https://api.github.com/users/elfmaster/repos","events_url":"https://api.github.com/users/elfmaster/events{/privacy}","received_events_url":"https://api.github.com/users/elfmaster/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-29T22:09:17Z","updated_at":"2015-10-29T22:09:17Z","closed_at":null,"body":"\r\n\r\nA buffer overflow if there is a large enough symbol string table. In the loop simply add a check to make sure that symstroff does not exceed 8192 * 32, if so, then perhaps a realloc to a larger buf size.\r\n\r\n        char *strtab = heapAlloc(8192 * 32);\r\n... <code> ...\r\n\r\n for (i = 0; i < fncount; i++) {\r\n                symtab[i].st_value = fdp[i].addr;\r\n                symtab[i].st_size = fdp[i].size;\r\n                symtab[i].st_info = (((STB_GLOBAL) << 4) + ((STT_FUNC) & 0xf));\r\n                symtab[i].st_other = 0;\r\n                symtab[i].st_shndx = text_shdr_index;\r\n                symtab[i].st_name = symstroff;\r\n                sname = xfmtstrdup(\"sub_%lx\", fdp[i].addr);\r\n                strcpy(&strtab[symstroff], sname);\r\n                symstroff += strlen(sname) + 1;\r\n                free(sname);\r\n        }\r\n"}}