From 01efeb144322c61e53cc4e21783ce0a69ec28922 Mon Sep 17 00:00:00 2001
From: Sebastien GODARD <sysstat@users.noreply.github.com>
Date: Sat, 26 Aug 2017 14:42:28 +0200
Subject: [PATCH] Fix #162: sadc crashes on a mtab file with really long lines
A segmentation fault may happen with "sadc -S DISK..." or
"sadc -S XDISK..." when lines longer than 512 bytes are read from
/etc/mtab.
Such lines are possible for instance when overlay2 filesystem
with docker is used. In such a case a single mtab entry can look
like this (note that new line characters were added for readability,
the original entry contained only one '\n' at the end):
overlay /var/lib/docker/overlay2/f23d2377a67b9ab1b49555ecd09b2ccdc03
7e0ee5d9e54f87e59f07f4398e71f/merged overlay rw,relatime,lowerdir=/v
ar/lib/docker/overlay2/l/L6VKIYXWBQSJ5R7V35SS43R6Y6:/var/lib/docker/
overlay2/l/UCCHKGXUJPWCMLHR36IZJNNIQP:/var/lib/docker/overlay2/l/RKV
YEXD2FH65FTMK76RDWPLESX:/var/lib/docker/overlay2/l/DX4JZRKTFP2GOO4V6
OWQ6CPJFY:/var/lib/docker/overlay2/l/6CYNWDKADUPPDZJ5IHOH2R7Y5S:/var
/lib/docker/overlay2/l/JTPINUZIATXADL6XWFHG2OYGSF:/var/lib/docker/ov
erlay2/l/OTSTIV5TTRHF4IUD7BODQ2FUON:/var/lib/docker/overlay2/l/QFNH3
EFS5EZGRTC4DPHU3PJ4TU:/var/lib/docker/overlay2/l/ZOOUKT2E5U4CSLP57Z7
MXYX5CD:/var/lib/docker/overlay2/l/3LUU6IDR2HWPTVBARC5K6XSMRC:/var/l
ib/docker/overlay2/l/XOHYBP4RWXQKQZ43I7JKG24KE4:/var/lib/docker/over
lay2/l/MN5M5B7AY5LPXQQC6V2MBJWWBF:/var/lib/docker/overlay2/l/3DRMKQ3
4AIZD2AROU3TVK3OCUT:/var/lib/docker/overlay2/l/73ZXDHBV6C53Q3SPXA57E
OLGHU:/var/lib/docker/overlay2/l/C2IZBQ55EUTGEAAORSLE73ZPNM:/var/lib
/docker/overlay2/l/ITHARNV7RPWN5S3BCZ2QDMZIMJ:/var/lib/docker/overla
y2/l/TQKUV4LEG4AFUUCMFHHRLDBHAH:/var/lib/docker/overlay2/l/N75JZWPPD
EKJ4DTN4GMEGTDIZL:/var/lib/docker/overlay2/l/QGUUYAETPMK643DG3AKWJAI
IZA,upperdir=/var/lib/docker/overlay2/f23d2377a67b9ab1b49555ecd09b2c
cdc037e0ee5d9e54f87e59f07f4398e71f/diff,workdir=/var/lib/docker/over
lay2/f23d2377a67b9ab1b49555ecd09b2ccdc037e0ee5d9e54f87e59f07f4398e71
f/work 0 0
The crash occurs in the get_filesystem_nr() and read_filesystem()
functions which call strchr(line, ' ') but fail to check if the result
is not NULL.
This patch adds this check, and when a single mtab entry requires more
that one call to fgets() (i.e. the entry is longer than 512 bytes), it
ignores outcome of the second and following calls.
Bugs-Debian: https://bugs.debian.org/872926
Signed-off-by: Robert Luberda <robert@debian.org>
Signed-off-by: Sebastien GODARD <sysstat@users.noreply.github.com>
(cherry picked from commit d40c8ecc530303d7e802617f21a9ac85dbcd68bd)
---
rd_stats.c | 41 ++++++++++++++++++++++++++++++++++++-----
1 file changed, 36 insertions(+), 5 deletions(-)
diff --git a/rd_stats.c b/rd_stats.c
index 01276b6..c054b58 100644
--- a/rd_stats.c
+++ b/rd_stats.c
@@ -1916,15 +1916,30 @@ void read_filesystem(struct stats_filesystem *st_filesystem, int nbr)
{
FILE *fp;
char line[512], fs_name[128], mountp[256];
- int fs = 0;
+ int fs = 0, skip = 0, skip_next = 0;
+ char *pos = 0;
struct stats_filesystem *st_filesystem_i;
struct statvfs buf;
if ((fp = fopen(MTAB, "r")) == NULL)
return;
- while ((fgets(line, 256, fp) != NULL) && (fs < nbr)) {
+ while ((fgets(line, sizeof(line), fp) != NULL) && (fs < nbr)) {
+ /*
+ * Ignore line if the preceding line did not contain '\n'.
+ * (Some very long lines may be found for instance when
+ * overlay2 filesystem with docker is used).
+ */
+ skip = skip_next;
+ skip_next = (strchr(line, '\n') == NULL);
+ if (skip)
+ continue;
+
if (line[0] == '/') {
+ /* Find field separator position */
+ pos = strchr(line, ' ');
+ if (pos == NULL)
+ continue;
/* Read current filesystem name */
sscanf(line, "%127s", fs_name);
@@ -1937,7 +1952,7 @@ void read_filesystem(struct stats_filesystem *st_filesystem, int nbr)
* from the fs name. This will result in a bogus name
* and following statvfs() function will always fail.
*/
- sscanf(strchr(line, ' ') + 1, "%255s", mountp);
+ sscanf(pos + 1, "%255s", mountp);
/* Replace octal codes */
oct2chr(mountp);
@@ -2397,7 +2412,9 @@ int get_filesystem_nr(void)
{
FILE *fp;
char line[512], fs_name[MAX_FS_LEN], mountp[256];
- int fs = 0;
+ int fs = 0, skip = 0, skip_next = 0;
+ char *pos = 0;
+
struct statvfs buf;
if ((fp = fopen(MTAB, "r")) == NULL)
@@ -2406,11 +2423,25 @@ int get_filesystem_nr(void)
/* Get current filesystem */
while (fgets(line, 256, fp) != NULL) {
+ /*
+ * Ignore line if the preceding line did not contain '\n'.
+ * (Some very long lines may be found for instance when
+ * overlay2 filesystem with docker is used).
+ */
+ skip = skip_next;
+ skip_next = (strchr(line, '\n') == NULL);
+ if (skip)
+ continue;
+
if (line[0] == '/') {
+ /* Find field separator position */
+ pos = strchr(line, ' ');
+ if (pos == NULL)
+ continue;
/* Read filesystem name and mount point */
sscanf(line, "%127s", fs_name);
- sscanf(strchr(line, ' ') + 1, "%255s", mountp);
+ sscanf(pos + 1, "%255s", mountp);
/* Replace octal codes */
oct2chr(mountp);
--
2.14.3