Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1382619

Re: [PATCH] perf buildid: fix off-by-one in write_buildid()

Show all headers | View raw

On 04/19/2016 04:38 PM, Arnaldo Carvalho de Melo wrote:
> Em Tue, Apr 19, 2016 at 11:17:27AM +0300, Andrey Ryabinin escreveu:
>> write_buildid() increments 'name_len' with intention to take into account
>> trailing zero byte. However, 'name_len' was already incremented in
>> machine__write_buildid_table() before.
>> So this leads to out-of-bounds read in do_write():
> 
> Could we keep the assumptions that for a string 's' the length is
> strlen(s) and that when we want to write a string _with_ its trailing
> '\0' we should use strlen(s) + 1?
> 
> I.e. I propose this patch instead, ok?
> 

Yup, looks good. Thanks.

> diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
> index 0573c2ec861d..b6ecf87bc3e3 100644
> --- a/tools/perf/util/build-id.c
> +++ b/tools/perf/util/build-id.c
> @@ -261,14 +261,14 @@ static int machine__write_buildid_table(struct machine *machine, int fd)
>  
>  		if (dso__is_vdso(pos)) {
>  			name = pos->short_name;
> -			name_len = pos->short_name_len + 1;
> +			name_len = pos->short_name_len;
>  		} else if (dso__is_kcore(pos)) {
>  			machine__mmap_name(machine, nm, sizeof(nm));
>  			name = nm;
> -			name_len = strlen(nm) + 1;
> +			name_len = strlen(nm);
>  		} else {
>  			name = pos->long_name;
> -			name_len = pos->long_name_len + 1;
> +			name_len = pos->long_name_len;
>  		}
>  
>  		in_kernel = pos->kernel ||
>  

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] perf buildid: fix off-by-one in write_buildid() Andrey Ryabinin <aryabinin@virtuozzo.com> - 2016-04-19 10:20 +0200
  Re: [PATCH] perf buildid: fix off-by-one in write_buildid() Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-04-19 15:40 +0200
    Re: [PATCH] perf buildid: fix off-by-one in write_buildid() Andrey Ryabinin <aryabinin@virtuozzo.com> - 2016-04-19 17:50 +0200
  Re: [PATCH] perf buildid: fix off-by-one in write_buildid() Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-04-19 15:50 +0200
    Re: [PATCH] perf buildid: fix off-by-one in write_buildid() Adrian Hunter <adrian.hunter@intel.com> - 2016-04-20 14:50 +0200
      Re: [PATCH] perf buildid: fix off-by-one in write_buildid() Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-04-20 15:30 +0200
  [tip:perf/core] perf buildid: Fix off-by-one in write_buildid() tip-bot for Andrey Ryabinin <tipbot@zytor.com> - 2016-04-27 17:30 +0200

csiph-web