From 1052091107395daa3d2592aeac44ed742ef1a22f Mon Sep 17 00:00:00 2001 From: Qualys Security Advisory Date: Thu, 1 Jan 1970 00:00:00 +0000 Subject: [PATCH] 0076-proc/readproc.c: Harden vectorize_this_str(). This detects an integer overflow of "strlen + 1", prevents an integer overflow of "tot + adj + (2 * pSZ)", and avoids calling snprintf with a string longer than INT_MAX. Truncate rather than fail, since the callers do not expect a failure of this function. ---------------------------- adapted for newlib branch . logic is now in pids.c . former 'vectorize_this_str' is now 'pids_vectorize_this' Signed-off-by: Jim Warner --- proc/pids.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/proc/pids.c b/proc/pids.c index 5928e4f6..b1d15723 100644 --- a/proc/pids.c +++ b/proc/pids.c @@ -97,9 +97,10 @@ struct pids_info { static char** pids_vectorize_this (const char* src) { #define pSZ (sizeof(char*)) char *cpy, **vec; - int adj, tot; + size_t adj, tot; tot = strlen(src) + 1; // prep for our vectors + if (tot < 1 || tot >= INT_MAX) tot = INT_MAX-1; // integer overflow? adj = (pSZ-1) - ((tot + pSZ-1) & (pSZ-1)); // calc alignment bytes cpy = calloc(1, tot + adj + (2 * pSZ)); // get new larger buffer if (!cpy) return NULL; // oops, looks like ENOMEM