From: Ian Rogers <irogers@google.com>
To: linux-trace-devel@vger.kernel.org,
Tzvetomir Stoyanov <tz.stoyanov@gmail.com>,
Steven Rostedt <rostedt@goodmis.org>,
Claire Jensen <cjense@google.com>
Cc: Ian Rogers <irogers@google.com>
Subject: [PATCH 1/2] libtraceevent: Add eof checks.
Date: Fri, 11 Jun 2021 18:45:00 -0700 [thread overview]
Message-ID: <20210612014501.890593-2-irogers@google.com> (raw)
In-Reply-To: <20210612014501.890593-1-irogers@google.com>
From: Claire Jensen <cjense@google.com>
Added checking for __read_char and peek_char to make sure value is not at end
of file.
Signed-off-by: Claire Jensen <cjense@google.com>
Signed-off-by: Ian Rogers <irogers@google.com>
---
src/event-parse.c | 62 ++++++++++++++++++++++++++++++++++++-----------
1 file changed, 48 insertions(+), 14 deletions(-)
diff --git a/src/event-parse.c b/src/event-parse.c
index 9915cb4..ac11887 100644
--- a/src/event-parse.c
+++ b/src/event-parse.c
@@ -1155,17 +1155,16 @@ static enum tep_event_type force_token(const char *str, char **tok);
static enum tep_event_type __read_token(char **tok)
{
char buf[BUFSIZ];
- int ch, last_ch, quote_ch, next_ch;
+ int ch, last_ch, quote_ch, next_ch, read_ch, peek_ch;
int i = 0;
int tok_size = 0;
enum tep_event_type type;
*tok = NULL;
-
- ch = __read_char();
+ ch = __read_char();
if (ch < 0)
- return TEP_EVENT_NONE;
+ goto out_eof_error;
type = get_type(ch);
if (type == TEP_EVENT_NONE)
@@ -1184,9 +1183,15 @@ static enum tep_event_type __read_token(char **tok)
case TEP_EVENT_OP:
switch (ch) {
case '-':
- next_ch = peek_char();
+ peek_ch = peek_char();
+ if (peek_ch < 0)
+ goto out_eof_error;
+ next_ch = peek_ch;
if (next_ch == '>') {
- buf[i++] = __read_char();
+ read_ch = __read_char();
+ if (read_ch < 0)
+ goto out_eof_error;
+ buf[i++] = read_ch;
break;
}
/* fall through */
@@ -1197,9 +1202,14 @@ static enum tep_event_type __read_token(char **tok)
case '<':
last_ch = ch;
ch = peek_char();
+ if (ch < 0)
+ goto out_eof_error;
if (ch != last_ch)
goto test_equal;
- buf[i++] = __read_char();
+ read_ch = __read_char();
+ if (read_ch < 0)
+ goto out_eof_error;
+ buf[i++] = read_ch;
switch (last_ch) {
case '>':
case '<':
@@ -1219,10 +1229,17 @@ static enum tep_event_type __read_token(char **tok)
return type;
test_equal:
- ch = peek_char();
- if (ch == '=')
- buf[i++] = __read_char();
- goto out;
+ peek_ch = peek_char();
+ if (peek_ch < 0)
+ goto out_eof_error;
+ ch = peek_ch;
+ if (ch == '=') {
+ read_ch = __read_char();
+ if (read_ch < 0)
+ goto out_eof_error;
+ buf[i++] = read_ch;
+ goto out;
+ }
case TEP_EVENT_DQUOTE:
case TEP_EVENT_SQUOTE:
@@ -1242,6 +1259,8 @@ static enum tep_event_type __read_token(char **tok)
}
last_ch = ch;
ch = __read_char();
+ if(ch < 0)
+ goto out_eof_error;
buf[i++] = ch;
/* the '\' '\' will cancel itself */
if (ch == '\\' && last_ch == '\\')
@@ -1259,6 +1278,8 @@ static enum tep_event_type __read_token(char **tok)
do {
ch = __read_char();
+ if(ch < 0)
+ return TEP_EVENT_NONE;
} while (isspace(ch));
if (ch == '"')
goto concat;
@@ -1273,7 +1294,13 @@ static enum tep_event_type __read_token(char **tok)
break;
}
- while (get_type(peek_char()) == type) {
+ while (1) {
+ peek_ch = peek_char();
+ if (peek_ch < 0)
+ goto out_eof_error;
+ if (get_type(peek_ch) != type)
+ break;
+
if (i == (BUFSIZ - 1)) {
buf[i] = 0;
tok_size += BUFSIZ;
@@ -1282,8 +1309,10 @@ static enum tep_event_type __read_token(char **tok)
return TEP_EVENT_NONE;
i = 0;
}
- ch = __read_char();
- buf[i++] = ch;
+ read_ch = __read_char();
+ if (read_ch < 0)
+ goto out_eof_error;
+ buf[i++] = read_ch;
}
out:
@@ -1316,6 +1345,11 @@ static enum tep_event_type __read_token(char **tok)
}
return type;
+
+out_eof_error:
+ free(*tok);
+ *tok = NULL;
+ return TEP_EVENT_NONE;
}
static enum tep_event_type force_token(const char *str, char **tok)
--
2.32.0.272.g935e593368-goog
next prev parent reply other threads:[~2021-06-12 1:46 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-12 1:44 [PATCH 0/2] Build and fuzzing related fixes Ian Rogers
2021-06-12 1:45 ` Ian Rogers [this message]
2021-06-13 23:30 ` [PATCH 1/2] libtraceevent: Add eof checks Steven Rostedt
[not found] ` <CAFPGG2iQK8XMv6Z1-KurgjOnYuk=m=uWNWJXj6OEb_SBQkokZA@mail.gmail.com>
2021-06-17 19:01 ` Steven Rostedt
2021-06-12 1:45 ` [PATCH 2/2] libtraceevent: Changed angled brackets to double quotes Ian Rogers
2021-06-12 23:00 ` Steven Rostedt
2021-06-13 21:31 ` Ian Rogers
2021-06-13 23:29 ` Steven Rostedt
2021-06-14 16:14 ` Ian Rogers
2021-06-14 18:43 ` Steven Rostedt
2021-06-17 19:43 [PATCH 1/2] libtraceevent: Add eof checks Claire Jensen
2021-06-17 19:58 ` Steven Rostedt
2021-06-24 1:06 ` Steven Rostedt
2021-06-24 5:50 ` Ian Rogers
2021-06-24 13:14 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210612014501.890593-2-irogers@google.com \
--to=irogers@google.com \
--cc=cjense@google.com \
--cc=linux-trace-devel@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=tz.stoyanov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).