kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zdump/dfi_vmcoreinfo: Sanity checks for n_namesz in ELF Notes header

Browse Source 
The dfi_vmcoreinfo_init() function might be called on a dump of a non-ELF
format because the DFI goes through all supported dump formats when first
trying to identify of what dump format the given input is. Therefore,
we must be very careful in interpreting read data and ensure that it
makes sense before accessing or using it.

This commit prevents a potential overflow of a stack buffer in
dfi_vmcoreinfo_init() if note.n_namesz is bigger than the stack buffer.

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Alexander Egorenkov
2021-08-31 10:54:20 +02:00
committed by Jan Höppner
parent 01551f98d5
commit 686c331b69
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
zdump/dfi_vmcoreinfo.c
View File

@@ -94,6 +94,8 @@ void dfi_vmcoreinfo_init(void)
return;
if (dfi_mem_read_rc(addr, &note, sizeof(note)))
return;
if (note.n_namesz == 0 || note.n_namesz > sizeof(str))
return;
memset(str, 0, sizeof(str));
if (dfi_mem_read_rc(addr + sizeof(note), str, note.n_namesz))
return;