emo/procps
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

proc/slab.h: Fix off-by-one overflow in sscanf().

Browse Source 
In proc/slab.c, functions parse_slabinfo20() and parse_slabinfo11(),
sscanf() might overflow curr->name, because "String input conversions
store a terminating null byte ('\0') to mark the end of the input; the
maximum field width does not include this terminator."

Add one byte to name[] for this terminator.
This commit is contained in:
Qualys Security Advisory 1970-01-01 00:00:00 +00:00 committed by Craig Small
parent bf12b14db9
commit 3ccc6ed262
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
proc/slab.h
View File

@ -4,7 +4,7 @@
#define SLAB_INFO_NAME_LEN 128 #define SLAB_INFO_NAME_LEN 128
struct slab_info { struct slab_info {
char name[SLAB_INFO_NAME_LEN]; /* name of this cache */ char name[SLAB_INFO_NAME_LEN+1]; /* name of this cache */
struct slab_info *next; struct slab_info *next;
unsigned long cache_size; /* size of entire cache */ unsigned long cache_size; /* size of entire cache */
unsigned nr_objs; /* number of objects in this cache */ unsigned nr_objs; /* number of objects in this cache */