Linux-Trace-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] trace-cmd: Limit the size written into the pid mapname
@ 2019-08-30 16:56 Steven Rostedt
  0 siblings, 0 replies; only message in thread
From: Steven Rostedt @ 2019-08-30 16:56 UTC (permalink / raw)
  To: Linux Trace Devel


From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>

Need to tell scanf() the size of the mapname so that we don't risk a buffer
overflow. As STRINGIFY() will make a string from the size, we can't use
"PATH_MAX + 22", but 4096 should be plenty big enough.

Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
---
 lib/trace-cmd/trace-input.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/trace-cmd/trace-input.c b/lib/trace-cmd/trace-input.c
index 8cceb31c..1db1bffa 100644
--- a/lib/trace-cmd/trace-input.c
+++ b/lib/trace-cmd/trace-input.c
@@ -20,6 +20,9 @@
 #include "kbuffer.h"
 #include "list.h"
 
+#define _STRINGIFY(x) #x
+#define STRINGIFY(x) _STRINGIFY(x)
+
 #define MISSING_EVENTS (1 << 31)
 #define MISSING_STORED (1 << 30)
 
@@ -2164,11 +2167,12 @@ static void procmap_free(struct pid_addr_maps *maps)
 	free(maps);
 }
 
-#define STR_PROCMAP_LINE_MAX	(PATH_MAX+22)
+/* Needs to be a constant, and 4K should be good enough */
+#define STR_PROCMAP_LINE_MAX	4096
 static int trace_pid_map_load(struct tracecmd_input *handle, char *buf)
 {
 	struct pid_addr_maps *maps = NULL;
-	char mapname[STR_PROCMAP_LINE_MAX];
+	char mapname[STR_PROCMAP_LINE_MAX+1];
 	char *line;
 	int res;
 	int ret;
@@ -2187,7 +2191,7 @@ static int trace_pid_map_load(struct tracecmd_input *handle, char *buf)
 	if (strlen(buf) > STR_PROCMAP_LINE_MAX)
 		goto out_fail;
 
-	res = sscanf(buf, "%x %x %s", &maps->pid, &maps->nr_lib_maps, mapname);
+	res = sscanf(buf, "%x %x %"STRINGIFY(STR_PROCMAP_LINE_MAX)"s", &maps->pid, &maps->nr_lib_maps, mapname);
 	if (res != 3)
 		goto out_fail;
 
-- 
2.20.1


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-30 16:56 [PATCH] trace-cmd: Limit the size written into the pid mapname Steven Rostedt

Linux-Trace-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-trace-devel/0 linux-trace-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-trace-devel linux-trace-devel/ https://lore.kernel.org/linux-trace-devel \
		linux-trace-devel@vger.kernel.org linux-trace-devel@archiver.kernel.org
	public-inbox-index linux-trace-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-trace-devel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox