Mikhail Zaslonko d3ac9f3365 zdump/dfi_vmdump: Validate ADSR sec5_len before buffer read ...

The 16-bit sec5_len field from the ADSR record was used directly as
the byte count for zg_read() and ebc_2_asc() into a pair of 1024-byte
stack buffers.  A crafted VMDUMP file with sec5_len > 1024 would
overflow both buffers and write past the stack frame.

The overflow is only reachable when zgetdump is invoked with the -V
(verbose) flag, but that is a common diagnostic usage.

Section 5 contains a human-readable dump symptom string used only for
display purposes.  Truncate sec5_len to sizeof(buf) - 1 so that
oversized values are silently clamped rather than causing an abort,
and the symptom string is still printed up to the buffer limit.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

2026-07-20 15:25:59 +02:00

16 KiB

Raw Blame History

View Raw