emo/procps
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

proc/readproc.c: Harden vectorize_this_str().

Browse Source 
This detects an integer overflow of "strlen + 1", prevents an integer
overflow of "tot + adj + (2 * pSZ)", and avoids calling snprintf with a
string longer than INT_MAX. Truncate rather than fail, since the callers
do not expect a failure of this function.
This commit is contained in:
Qualys Security Advisory 1970-01-01 00:00:00 +00:00 committed by Craig Small
parent 39dcf47bc8
commit 6939463606
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
proc/readproc.c
View File

@ -801,9 +801,10 @@ static int read_unvectored(char *restrict const dst, unsigned sz, const char* wh
static char** vectorize_this_str (const char* src) { static char** vectorize_this_str (const char* src) {
#define pSZ (sizeof(char*)) #define pSZ (sizeof(char*))
char *cpy, **vec; char *cpy, **vec;
int adj, tot; size_t adj, tot;
tot = strlen(src) + 1; // prep for our vectors tot = strlen(src) + 1; // prep for our vectors
if (tot < 1 || tot >= INT_MAX) tot = INT_MAX-1; // integer overflow?
adj = (pSZ-1) - ((tot + pSZ-1) & (pSZ-1)); // calc alignment bytes adj = (pSZ-1) - ((tot + pSZ-1) & (pSZ-1)); // calc alignment bytes
cpy = xcalloc(tot + adj + (2 * pSZ)); // get new larger buffer cpy = xcalloc(tot + adj + (2 * pSZ)); // get new larger buffer
snprintf(cpy, tot, "%s", src); // duplicate their string snprintf(cpy, tot, "%s", src); // duplicate their string