ld/pdb: Fix PDB source-info substream overflow
A fix for a PDB substream overflow bug in the linker by increasing the size of a counter.
This patch addresses a bug in the linker’s PDB (Program Database) handling where a uint16_t counter for source file references could overflow if a link involved more than 65,535 references. This overflow led to a buffer allocation that was too small for the source-info substream, resulting in a write past the buffer’s end. The fix changes the counter to uint32_t to accommodate a larger number of references.
- reviewer
Acknowledges and accepts the proposed fix.
“Okay.”
- proposer
Explains that `source_files_count` was too narrow and caused buffer overflows when exceeding 65,535 references, proposing to change it to `uint32_t`.
“source_files_count counts every source file reference across all modules, not the deduplicated count that goes into the substream header, so a uint16_t is too narrow. A link with more than 65535 references wraps it, allocates too small a buffer for the source-info substream, and then writes past the end of it.”
Technical Tradeoffs
- Increased memory usage for the `source_files_count` variable, though negligible.
- Fixes a potential crash/corruption bug.
In Details
This patch in ld/pdb.c fixes a buffer overflow vulnerability within the PDB (Program Database) generation for Windows executables. The overflow occurs in the create_source_info_substream function when the number of unique source file entries exceeds the capacity of a uint16_t used to track them. By promoting source_files_count to uint32_t, the linker can correctly handle larger object files with numerous source files, preventing writes beyond the allocated buffer for the PDB's source information substream.
- PDB
- Program Database. A file format used by Microsoft Windows to store information about executable files, used by debuggers and other tools.
- linker
- A program that combines object code from multiple sources into a single executable or library.
- substream
- A smaller, logically distinct part of a larger data structure, such as within a PDB file.