[Bug other/54411] libiberty: objalloc_alloc integer overflows (CVE-2012-3509)

[joseph at codesourcery dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54411

--- Comment #4 from joseph at codesourcery dot com <joseph at codesourcery dot com> 2012-08-29 21:29:12 UTC ---
On Wed, 29 Aug 2012, fw at gcc dot gnu.org wrote:

> > You do realise that pretty much nothing in the toolchain checks for 
> > overflows in calculating allocation sizes?
> 
> bfd_alloc2 (bfd's XNEWVEC variant) contains an overflow check, and this bug
> defeats it.
> 
> Your point about XNEWVEC is appreciated, but this is a different bug. 8-)

My point is that there are probably hundreds of such bugs in the toolchain 
sources (and lots more bugs where BFD and GDB fail to handle invalid 
input); XNEWVEC is just an example of one that's comparatively easy to 
find and fix (but I'm sure plenty more are easy to find for anyone going 
looking for them).