mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
The command line length value is not properly checked and limited to the documented 1024 bytes, even though a MAX_CMD_LEN is already defined but not used. With this, an overflow of the static char mon_record[] buffer is possible in read_cmdline(), corrupting adjacent .bss data. The data is sanitized to printable ASCII bytes, but in theory a crash of the mon_procd daemon could be possible. Fix it by adding a check and truncation similar to the other restricted fields like e.g. ruser_len or cmd_len. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>