Headline
CVE-2022-28070: Fix oobread crash in the analysis loop with corrupted ELFs (tests_649… · radareorg/radare2@4aff1bb
A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
Expand Up
@@ -831,7 +831,7 @@ static bool __core_anal_fcn(RCore *core, ut64 at, ut64 from, int reftype, int de
const RList *syms = r_bin_get_symbols (core->bin);
ut64 baddr = r_config_get_i (core->config, “bin.baddr”);
r_list_foreach (syms, iter, sym) {
if ((sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
if (sym->type && (sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
free (new_name);
new_name = r_str_newf ("sym.%s", sym->name);
break;
Expand Down