mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
405b2da3f3
vmcoreinfo_item() copies a key's value string from the vmcoreinfo heap blob into the caller's buffer using memcpy() without checking the source length. The length is derived from the distance between the '=' separator and the next '\n' (or '\0') in the blob, which is bounded only by the total vmcoreinfo size. A crafted dump with a vmcoreinfo value >= 1024 bytes would overflow the buffer. Additionally, the len parameter of vmcoreinfo_item() was declared UNUSED and never checked. Fix by computing val_len before the copy and returning -1 if val_len >= len. Change len type from int to size_t, which is natural for a buffer size, drops the need for a negativity guard, and makes the call site passing sizeof(str) type-consistent. Write directly into the caller's buf, instead of going through the intermediate str[]. Replace two strchr() calls with a single strchrnul(). Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
22 lines
743 B
C
22 lines
743 B
C
/*
|
|
* Copyright IBM Corp. 2001, 2018
|
|
*
|
|
* s390-tools is free software; you can redistribute it and/or modify
|
|
* it under the terms of the MIT license. See LICENSE for details.
|
|
*/
|
|
|
|
#ifndef DFI_VMCOREINFO_H
|
|
#define DFI_VMCOREINFO_H
|
|
|
|
void dfi_vmcoreinfo_init(void);
|
|
const char *dfi_vmcoreinfo_get(void);
|
|
int dfi_vmcoreinfo_tag(char *str, size_t len, const char *sym);
|
|
int dfi_vmcoreinfo_symbol(unsigned long *val, const char *sym);
|
|
int dfi_vmcoreinfo_offset(unsigned long *offs, const char *sym);
|
|
int dfi_vmcoreinfo_size(unsigned long *size, const char *sym);
|
|
int dfi_vmcoreinfo_length(unsigned long *len, const char *sym);
|
|
int dfi_vmcoreinfo_val(unsigned long *val, const char *sym);
|
|
u64 dfi_vm_vtop(u64 vaddr);
|
|
|
|
#endif /* DFI_VMCOREINFO_H */
|