|
 |
765b01 |
From 401e037e5e9527134c594b8923342a69ff38b7cb Mon Sep 17 00:00:00 2001
|
|
|
765b01 |
From: Arthur Zou <zzou@redhat.com>
|
|
|
765b01 |
Date: Wed, 12 Mar 2014 13:05:18 +0800
|
|
|
765b01 |
Subject: [PATCH] vmcore-dmesg stack smashing happend in extreme case
|
|
|
765b01 |
|
|
|
765b01 |
Description
|
|
|
765b01 |
in dump_dmesg_structured() the out_buf size is 4096, and if the
|
|
|
765b01 |
length is less than 4080( 4096-16 ) it won't really write out.
|
|
|
765b01 |
Normally, after writing one or four chars to the out_buf, it will
|
|
|
765b01 |
check the length of out_buf. But in extreme cases, 19 chars was
|
|
|
765b01 |
written to the out_buf before checking the length. This may cause
|
|
|
765b01 |
the stack corruption. If the length was 4079 (won't realy write out),
|
|
|
765b01 |
and then write 19 chars to it. the out_buf will overflow.
|
|
|
765b01 |
|
|
|
765b01 |
Solution
|
|
|
765b01 |
Change 16 to 64 thus can make sure that always have 64bytes before
|
|
|
765b01 |
moving to next records. why using 64 is that a long long int can take
|
|
|
765b01 |
20 bytes. so the length of timestamp can be 44 ('[','.',']',' ') in
|
|
|
765b01 |
extreme case.
|
|
|
765b01 |
|
|
|
765b01 |
Signed-off-by: Arthur Zou <zzou@redhat.com>
|
|
|
765b01 |
Acked-by: Vivek Goyal <vgoyal@redhat.com>
|
|
|
765b01 |
Signed-off-by: Simon Horman <horms@verge.net.au>
|
|
|
765b01 |
---
|
|
|
765b01 |
vmcore-dmesg/vmcore-dmesg.c | 2 +-
|
|
|
765b01 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
765b01 |
|
|
|
765b01 |
diff --git a/vmcore-dmesg/vmcore-dmesg.c b/vmcore-dmesg/vmcore-dmesg.c
|
|
|
765b01 |
index 0345660..e15cd91 100644
|
|
|
765b01 |
--- a/vmcore-dmesg/vmcore-dmesg.c
|
|
|
765b01 |
+++ b/vmcore-dmesg/vmcore-dmesg.c
|
|
|
765b01 |
@@ -674,7 +674,7 @@ static void dump_dmesg_structured(int fd)
|
|
|
765b01 |
else
|
|
|
765b01 |
out_buf[len++] = c;
|
|
|
765b01 |
|
|
|
765b01 |
- if (len >= OUT_BUF_SIZE - 16) {
|
|
|
765b01 |
+ if (len >= OUT_BUF_SIZE - 64) {
|
|
|
765b01 |
write_to_stdout(out_buf, len);
|
|
|
765b01 |
len = 0;
|
|
|
765b01 |
}
|
|
|
765b01 |
--
|
|
|
765b01 |
1.8.4.2
|
|
|
765b01 |
|