)]}'
{
  "commit": "4be1e8dbb3f8da8058ed93dfc222ee6dffb02e60",
  "tree": "80e545d4cf7a8bc7386b0af657b6efefb905123a",
  "parents": [
    "e63e5f9f9f9c7922dfc348b1637d1fd0a2b353d2"
  ],
  "author": {
    "name": "Alan Modra",
    "email": "amodra@gmail.com",
    "time": "Tue May 25 13:36:20 2021 +0930"
  },
  "committer": {
    "name": "Alan Modra",
    "email": "amodra@gmail.com",
    "time": "Tue May 25 15:07:08 2021 +0930"
  },
  "message": "asan: _bfd_elf_parse_attributes heap buffer overflow\n\nI exposed a problem with the change in commit 574ec1084d to the outer\nloop of _bfd_elf_parse_attributes.  \"p_end - p \u003e\u003d 4\" is better than\n\"p \u003c p_end - 4\" as far as pointer UB is concerned if the size of the\nattritbute section is say, 3 bytes.  However you do need to ensure p\nnever exceeds p_end, and that length remaining is kept consistent with\nthe pointer.\n\n\t* elf-attrs.c (elf_attr_strdup): New function.\n\t(_bfd_elf_attr_strdup): Use it here.\n\t(elf_add_obj_attr_string): New function, extracted from..\n\t(bfd_elf_add_obj_attr_string): ..here.\n\t(elf_add_obj_attr_int_string): New function, extracted from..\n\t(bfd_elf_add_obj_attr_int_string): ..here.\n\t(_bfd_elf_parse_attributes): Don\u0027t allocate an extra byte for a\n\tstring terminator.  Instead ensure parsing doesn\u0027t go past\n\tend of sub-section.  Use size_t variables for lengths.\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a240941eb003410b2ef7e607085ea179b29eaa2a",
      "old_mode": 33188,
      "old_path": "bfd/ChangeLog",
      "new_id": "516b81635853af95a3bf010c3e2a7ce34543cd57",
      "new_mode": 33188,
      "new_path": "bfd/ChangeLog"
    },
    {
      "type": "modify",
      "old_id": "e77b73a2a9702fc54e73e92c621b5c4edbf4b1c3",
      "old_mode": 33188,
      "old_path": "bfd/elf-attrs.c",
      "new_id": "11a81a3ba74ff024bc0285ed0d543c664dcfb443",
      "new_mode": 33188,
      "new_path": "bfd/elf-attrs.c"
    }
  ]
}