[PATCH 12/31] dwarves: Fix heap buffer overflow in languages__parse realloc

[Arnaldo Carvalho de Melo <acme@kernel.org>]

From: Arnaldo Carvalho de Melo <acme@redhat.com>

The realloc() call in languages__parse() passes nr_allocated as the
size in bytes, but the array holds int elements.  When nr_allocated
doubles past 4 (the initial allocation), the buffer is undersized by
a factor of sizeof(int), causing subsequent writes to corrupt heap
memory.

Before: realloc(entries, nr_allocated) — allocates nr_allocated bytes
After:  realloc(entries, nr_allocated * sizeof(int)) — allocates correct size

With 5+ comma-separated --lang arguments, this would write 4*sizeof(int)
bytes past the allocated buffer.

Fixes: 8fc09fd3315ce934 ("core: Adopt the languages__parse(), languages__in() and 'struct languages' from pahole")
Reported-by: Sashiko:gemini-3-1-pro-preview
Assisted-by: Claude:claude-sonnet-4-5
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
 dwarves.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dwarves.c b/dwarves.c
index 57a4bd063cc9413d..5c9d83a6dee897c2 100644
--- a/dwarves.c
+++ b/dwarves.c
@@ -2499,7 +2499,7 @@ int languages__parse(struct languages *languages, const char *tool)
 
 		if (languages->nr_entries >= nr_allocated) {
 			nr_allocated *= 2;
-			int *entries = realloc(languages->entries, nr_allocated);
+			int *entries = realloc(languages->entries, nr_allocated * sizeof(int));
 
 			if (entries == NULL)
 				goto out_enomem;
-- 
2.55.0