From b84714a47a3a1ec646bbd489442b305c84b35e15 Mon Sep 17 00:00:00 2001

From: jeromemarchand <38073585+jeromemarchand@users.noreply.github.com>

Date: Wed, 8 Aug 2018 18:09:44 +0200

Subject: [PATCH] Miscellaneous fixes (#1914)

* Fix multiple memory access errors

Fixes a buffer overflow in get_pid_exe(), a use-after-free error in

bcc_usdt_get_probe_argctype() and a possible NULL pointer dereference

in find_debug_via_debuglink().

* Fix multiple ressource leaks

Leaked file descriptors in bpf_attach_uprobe() and verify_checksum().

Memory leaks in  Parser::func_add() and bcc_procutils_language().

* fixup! Fix multiple ressource leaks

---

 src/cc/bcc_elf.c             | 6 ++++--

 src/cc/bcc_proc.c            | 4 +++-

 src/cc/common.cc             | 2 ++

 src/cc/frontends/b/parser.cc | 4 +++-

 src/cc/libbpf.c              | 1 +

 src/cc/usdt/usdt.cc          | 5 +++--

 6 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/src/cc/bcc_elf.c b/src/cc/bcc_elf.c

index e848912..c425db6 100644

--- a/src/cc/bcc_elf.c

+++ b/src/cc/bcc_elf.c

@@ -377,8 +377,10 @@ static int verify_checksum(const char *file, unsigned int crc) {

   if (fd < 0)

     return 0;

-  if (fstat(fd, &st) < 0)

+  if (fstat(fd, &st) < 0) {

+    close(fd);

     return 0;

+  }

   buf = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);

   if (!buf) {

@@ -433,7 +435,7 @@ static char *find_debug_via_debuglink(Elf *e, const char *binpath,

 DONE:

   free(bindir);

-  if (check_crc && !verify_checksum(res, crc))

+  if (res && check_crc && !verify_checksum(res, crc))

     return NULL;

   return res;

 }

diff --git a/src/cc/bcc_proc.c b/src/cc/bcc_proc.c

index 14ee18e..6fe11a0 100644

--- a/src/cc/bcc_proc.c

+++ b/src/cc/bcc_proc.c

@@ -446,8 +446,10 @@ const char *bcc_procutils_language(int pid) {

       while (isspace(mapname[0])) mapname++;

       for (i = 0; i < nb_languages; i++) {

         snprintf(pathname, sizeof(pathname), "/lib%s", languages[i]);

-        if (strstr(mapname, pathname))

+        if (strstr(mapname, pathname)) {

+          fclose(procfile);

           return languages[i];

+	}

         if ((str = strstr(mapname, "libc")) &&

             (str[4] == '-' || str[4] == '.'))

           libc = true;

diff --git a/src/cc/common.cc b/src/cc/common.cc

index 1cfe91a..c8370a3 100644

--- a/src/cc/common.cc

+++ b/src/cc/common.cc

@@ -57,6 +57,8 @@ std::string get_pid_exe(pid_t pid) {

   res = readlink(exe_link.c_str(), exe_path, sizeof(exe_path));

   if (res == -1)

     return "";

+  if (res >= sizeof(exe_path))

+    res = sizeof(exe_path) - 1;

   exe_path[res] = '\0';

   return std::string(exe_path);

 }

diff --git a/src/cc/frontends/b/parser.cc b/src/cc/frontends/b/parser.cc

index 9e61346..8a5e149 100644

--- a/src/cc/frontends/b/parser.cc

+++ b/src/cc/frontends/b/parser.cc

@@ -199,8 +199,10 @@ StmtNode * Parser::func_add(vector<int> *types, Scopes::StateScope *scope,

   auto cur_scope = scopes_->current_var();

   scopes_->set_current(scope);

   for (auto it = formals->begin(); it != formals->end(); ++it)

-    if (!variable_add(nullptr, it->get()))

+    if (!variable_add(nullptr, it->get())) {

+      delete decl;

       return nullptr;

+    }

   scopes_->set_current(cur_scope);

   decl->scope_ = scope;

   scopes_->top_func()->add(id->name_, decl);

diff --git a/src/cc/libbpf.c b/src/cc/libbpf.c

index c23030e..acfbc5e 100644

--- a/src/cc/libbpf.c

+++ b/src/cc/libbpf.c

@@ -925,6 +925,7 @@ static void exit_mount_ns(int fd) {

   if (setns(fd, CLONE_NEWNS))

     perror("setns");

+  close(fd);

 }

 int bpf_attach_uprobe(int progfd, enum bpf_probe_attach_type attach_type,

diff --git a/src/cc/usdt/usdt.cc b/src/cc/usdt/usdt.cc

index 2992593..2010520 100644

--- a/src/cc/usdt/usdt.cc

+++ b/src/cc/usdt/usdt.cc

@@ -478,8 +478,9 @@ const char *bcc_usdt_get_probe_argctype(

   void *ctx, const char* probe_name, const int arg_index

 ) {

   USDT::Probe *p = static_cast<USDT::Context *>(ctx)->get(probe_name);

-  std::string res = p ? p->get_arg_ctype(arg_index) : "";

-  return res.c_str();

+  if (p)

+    return p->get_arg_ctype(arg_index).c_str();

+  return "";

 }

 void bcc_usdt_foreach(void *usdt, bcc_usdt_cb callback) {

-- 

2.17.1