From 42eba672687a9512962cc72f3e1b177fddeb42ed Mon Sep 17 00:00:00 2001 From: Gerald Schaefer Date: Thu, 9 Jul 2026 16:24:39 +0200 Subject: [PATCH] mon_procd: Fix possible static buffer overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The command line length value is not properly checked and limited to the documented 1024 bytes, even though a MAX_CMD_LEN is already defined but not used. With this, an overflow of the static char mon_record[] buffer is possible in read_cmdline(), corrupting adjacent .bss data. The data is sanitized to printable ASCII bytes, but in theory a crash of the mon_procd daemon could be possible. Fix it by adding a check and truncation similar to the other restricted fields like e.g. ruser_len or cmd_len. Reviewed-by: Ilya Leoshkevich Signed-off-by: Gerald Schaefer Signed-off-by: Jan Höppner --- mon_tools/mon_procd.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mon_tools/mon_procd.c b/mon_tools/mon_procd.c index d0da1bb4..74701124 100644 --- a/mon_tools/mon_procd.c +++ b/mon_tools/mon_procd.c @@ -742,6 +742,8 @@ static int read_cmdline(struct task_t *task) buf[i] = ' '; } name_lens.cmdline_len = num; + if (name_lens.cmdline_len > MAX_CMD_LEN) + name_lens.cmdline_len = MAX_CMD_LEN; cmdlnlenp = mon_record + sizeof(struct monwrite_hdr); cmdlnlenp += sizeof(struct procd_hdr); cmdlnlenp += sizeof(struct task_t);