kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zdump/dfi_vmcoreinfo: Validate vmcoreinfo value length before memcpy

Browse Source 
vmcoreinfo_item() copies a key's value string from the vmcoreinfo heap
blob into the caller's buffer using memcpy() without checking the source
length. The length is derived from the distance between the '=' separator
and the next '\n' (or '\0') in the blob, which is bounded only by the
total vmcoreinfo size. A crafted dump with a vmcoreinfo value >= 1024
bytes would overflow the buffer.
Additionally, the len parameter of vmcoreinfo_item() was declared UNUSED
and never checked.
Fix by computing val_len before the copy and returning -1 if val_len >= len.
Change len type from int to size_t, which is natural for a buffer size,
drops the need for a negativity guard, and makes the call site passing
sizeof(str) type-consistent.
Write directly into the caller's buf, instead of going through the
intermediate str[].
Replace two strchr() calls with a single strchrnul().

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Mikhail Zaslonko
2026-06-29 19:46:21 +02:00
committed by Jan Höppner
parent d3ac9f3365
commit 405b2da3f3
2 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
zdump/dfi_vmcoreinfo.c
View File

@@ -169,13 +169,14 @@ const char *dfi_vmcoreinfo_get(void)
}
/*
* Generic function: Return vmcoreinfo item (-1 on failure)
* Generic function: Return vmcoreinfo item (-1 on failure).
*/
static int vmcoreinfo_item(char *buf, int UNUSED(len), const char *fmt,
static int vmcoreinfo_item(char *buf, size_t len, const char *fmt,
const char *sym)
{
char str[1024], *sym_str, *sym_str_end;
size_t val_len;
if (!l.vmcoreinfo)
return -1;
@@ -187,12 +188,12 @@ static int vmcoreinfo_item(char *buf, int UNUSED(len), const char *fmt,
if (!sym_str)
return -1;
sym_str += strlen(str);
sym_str_end = strchr(sym_str, '\n');
if (!sym_str_end)
sym_str_end = strchr(sym_str, '\0');
memset(str, 0, sizeof(str));
memcpy(str, sym_str, (unsigned long) (sym_str_end - sym_str));
strcpy(buf, str);
sym_str_end = strchrnul(sym_str, '\n');
val_len = (size_t)(sym_str_end - sym_str);
if (val_len >= len)
return -1;
memcpy(buf, sym_str, val_len);
buf[val_len] = '\0';
return 0;
}
@@ -216,7 +217,7 @@ static int vmcoreinfo_item_ulong(unsigned long *val, const char *fmt,
/*
* Return vmcoreinfo tag (-1 on failure)
*/
int dfi_vmcoreinfo_tag(char *str, int len, const char *sym)
int dfi_vmcoreinfo_tag(char *str, size_t len, const char *sym)
{
return vmcoreinfo_item(str, len, NULL, sym);
}

2
zdump/dfi_vmcoreinfo.h
View File

@@ -10,7 +10,7 @@
void dfi_vmcoreinfo_init(void);
const char *dfi_vmcoreinfo_get(void);
int dfi_vmcoreinfo_tag(char *str, int len, const char *sym);
int dfi_vmcoreinfo_tag(char *str, size_t len, const char *sym);
int dfi_vmcoreinfo_symbol(unsigned long *val, const char *sym);
int dfi_vmcoreinfo_offset(unsigned long *offs, const char *sym);
int dfi_vmcoreinfo_size(unsigned long *size, const char *sym);