diff options
author | Vivek Goyal <vgoyal@redhat.com> | 2012-07-18 09:33:51 -0400 |
---|---|---|
committer | Simon Horman <horms@verge.net.au> | 2012-07-24 09:27:01 +0900 |
commit | c96e7736d85e40685939011e6d51b3c0a28739a3 (patch) | |
tree | e7e0c86602c7f81c7b5ba0f7b541748d79f2e43f /vmcore-dmesg | |
parent | 583c81c1c5e52520d18efc612c5e6894f4a4ed10 (diff) |
vmcore-dmesg: Do not write beyond end of buffer
scan_vmcoreinfo() currently assumes that every vmcoreinfo note line ends
with \n and overwrites new line with \0. But last entry in note, CRASHTIME=
does not end with \n and this leads to corrupting memory as we write beyond
end of buffer.
Normally things were fine but when I added some fields to vmcoreinfo, this
bug started showing and vmcore-dmesg started crashing.
I am planning to send a patch to fix this in kernel but it might be good
idea to handle this case in user space too so that vmcore-dmesg works
fine with cores of older kernels.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Diffstat (limited to 'vmcore-dmesg')
-rw-r--r-- | vmcore-dmesg/vmcore-dmesg.c | 29 |
1 files changed, 28 insertions, 1 deletions
diff --git a/vmcore-dmesg/vmcore-dmesg.c b/vmcore-dmesg/vmcore-dmesg.c index 8518150..2e692de 100644 --- a/vmcore-dmesg/vmcore-dmesg.c +++ b/vmcore-dmesg/vmcore-dmesg.c @@ -14,6 +14,7 @@ #include <sys/stat.h> #include <fcntl.h> #include <elf.h> +#include <stdbool.h> /* The 32bit and 64bit note headers make it clear we don't care */ typedef Elf32_Nhdr Elf_Nhdr; @@ -220,6 +221,9 @@ static void scan_vmcoreinfo(char *start, size_t size) { char *last = start + size - 1; char *pos, *eol; + char temp_buf[1024]; + bool last_line = false; + #define SYMBOL(sym) { \ .str = "SYMBOL(" #sym ")=", \ .name = #sym, \ @@ -243,7 +247,27 @@ static void scan_vmcoreinfo(char *start, size_t size) /* Find the end of the current line */ for (eol = pos; (eol <= last) && (*eol != '\n') ; eol++) ; - len = eol - pos + 1; + if (eol > last) { + /* + * We did not find \n and note ended. Currently kernel + * is appending last field CRASH_TIME without \n. It + * is ugly but handle it. + */ + eol = last; + len = eol - pos + 1; + if (len >= sizeof(temp_buf)) + len = sizeof(temp_buf) - 1; + strncpy(temp_buf, pos, len); + temp_buf[len + 1] = '\0'; + + pos = temp_buf; + len = len + 1; + eol = pos + len -1; + last_line = true; + } else { + len = eol - pos + 1; + } + /* Stomp the last character so I am guaranteed a terminating null */ *eol = '\0'; /* Copy OSRELEASE if I see it */ @@ -266,6 +290,9 @@ static void scan_vmcoreinfo(char *start, size_t size) /* Remember the virtual address */ *symbol[i].vaddr = vaddr; } + + if (last_line) + break; } } |