From 686c331b69e44f952603002d46e7f88edf987762 Mon Sep 17 00:00:00 2001 From: Alexander Egorenkov Date: Tue, 31 Aug 2021 10:54:20 +0200 Subject: [PATCH] zdump/dfi_vmcoreinfo: Sanity checks for n_namesz in ELF Notes header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dfi_vmcoreinfo_init() function might be called on a dump of a non-ELF format because the DFI goes through all supported dump formats when first trying to identify of what dump format the given input is. Therefore, we must be very careful in interpreting read data and ensure that it makes sense before accessing or using it. This commit prevents a potential overflow of a stack buffer in dfi_vmcoreinfo_init() if note.n_namesz is bigger than the stack buffer. Signed-off-by: Alexander Egorenkov Signed-off-by: Jan Höppner --- zdump/dfi_vmcoreinfo.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/zdump/dfi_vmcoreinfo.c b/zdump/dfi_vmcoreinfo.c index 12fb16ee..98c05413 100644 --- a/zdump/dfi_vmcoreinfo.c +++ b/zdump/dfi_vmcoreinfo.c @@ -94,6 +94,8 @@ void dfi_vmcoreinfo_init(void) return; if (dfi_mem_read_rc(addr, ¬e, sizeof(note))) return; + if (note.n_namesz == 0 || note.n_namesz > sizeof(str)) + return; memset(str, 0, sizeof(str)); if (dfi_mem_read_rc(addr + sizeof(note), str, note.n_namesz)) return;