emo/procps
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

proc/readproc.c: Prevent integer overflows in readproctab*().

Browse Source 
If an integer overflow is about to be reached, call xalloc_err_handler()
(since it would have been caught by calloc() or reallocarray()) and then
exit(): these integer overflows are far from reachable, with the current
PID_MAX_LIMIT (2^22), so if they are there is something very wrong going
on. Note: we check the n_*alloc variables against INT_MAX even when they
are size_t because they are later stored as int in a struct proc_data_t.
This commit is contained in:
Qualys Security Advisory 1970-01-01 00:00:00 +00:00 committed by Craig Small
parent a013f6e020
commit 94eebb03b5
1 changed files with 33 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
proc/readproc.c
View File

@ -38,6 +38,7 @@
#include <sys/types.h> #include <sys/types.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <limits.h> #include <limits.h>
#include <stdint.h>
#ifdef WITH_SYSTEMD #ifdef WITH_SYSTEMD
#include <systemd/sd-login.h> #include <systemd/sd-login.h>
#endif #endif
@ -1525,6 +1526,10 @@ proc_t** readproctab(int flags, ...) {
if (!PT) if (!PT)
return 0; return 0;
do { /* read table: */ do { /* read table: */
if (n < 0 || (size_t)n >= INT_MAX / sizeof(proc_t*)) {
xalloc_err_handler("integer overflow in %s (%s=%zu)", __func__, "n", (size_t)n);
exit(EXIT_FAILURE);
}
tab = xrealloc(tab, (n+1)*sizeof(proc_t*));/* realloc as we go, using */ tab = xrealloc(tab, (n+1)*sizeof(proc_t*));/* realloc as we go, using */
tab[n] = readproc_direct(PT, NULL); /* final null to terminate */ tab[n] = readproc_direct(PT, NULL); /* final null to terminate */
} while (tab[n++]); /* stop when NULL reached */ } while (tab[n++]); /* stop when NULL reached */
@ -1532,33 +1537,44 @@ proc_t** readproctab(int flags, ...) {
return tab; return tab;
} }
#define grow_by_size(ptr, nmemb, over, size) do { \
if ((size_t)(nmemb) >= INT_MAX / 5) { \
xalloc_err_handler("integer overflow in %s (%s=%zu)", __func__, #nmemb, (size_t)(nmemb)); \
exit(EXIT_FAILURE); \
} \
(nmemb) = (nmemb) * 5 / 4 + (over); \
if ((size_t)(nmemb) >= SSIZE_MAX / (size)) { \
xalloc_err_handler("integer overflow in %s (%s=%zu)", __func__, #nmemb, (size_t)(nmemb)); \
exit(EXIT_FAILURE); \
} \
(ptr) = xrealloc((ptr), (nmemb) * (size)); \
} while (0)
// Try again, this time with threads and selection. // Try again, this time with threads and selection.
proc_data_t *readproctab2(int(*want_proc)(proc_t *buf), int(*want_task)(proc_t *buf), PROCTAB *restrict const PT) { proc_data_t *readproctab2(int(*want_proc)(proc_t *buf), int(*want_task)(proc_t *buf), PROCTAB *restrict const PT) {
static proc_data_t pd; static proc_data_t pd;
proc_t** ptab = NULL; proc_t** ptab = NULL;
unsigned n_proc_alloc = 0; size_t n_proc_alloc = 0;
unsigned n_proc = 0; size_t n_proc = 0;
proc_t** ttab = NULL; proc_t** ttab = NULL;
unsigned n_task_alloc = 0; size_t n_task_alloc = 0;
unsigned n_task = 0; size_t n_task = 0;
proc_t* data = NULL; proc_t* data = NULL;
unsigned n_alloc = 0; size_t n_alloc = 0;
unsigned long n_used = 0; uintptr_t n_used = 0;
for(;;){ for(;;){
proc_t *tmp; proc_t *tmp;
if(n_alloc == n_used){ if(n_alloc == n_used){
//proc_t *old = data; //proc_t *old = data;
n_alloc = n_alloc*5/4+30; // grow by over 25% grow_by_size(data, n_alloc, 30, sizeof(proc_t));
data = xrealloc(data,sizeof(proc_t)*n_alloc);
memset(data+n_used, 0, sizeof(proc_t)*(n_alloc-n_used)); memset(data+n_used, 0, sizeof(proc_t)*(n_alloc-n_used));
} }
if(n_proc_alloc == n_proc){ if(n_proc_alloc == n_proc){
//proc_t **old = ptab; //proc_t **old = ptab;
n_proc_alloc = n_proc_alloc*5/4+30; // grow by over 25% grow_by_size(ptab, n_proc_alloc, 30, sizeof(proc_t*));
ptab = xrealloc(ptab,sizeof(proc_t*)*n_proc_alloc);
} }
tmp = readproc_direct(PT, data+n_used); tmp = readproc_direct(PT, data+n_used);
if(!tmp) break; if(!tmp) break;
@ -1569,16 +1585,14 @@ proc_data_t *readproctab2(int(*want_proc)(proc_t *buf), int(*want_task)(proc_t *
proc_t *t; proc_t *t;
if(n_alloc == n_used){ if(n_alloc == n_used){
proc_t *old = data; proc_t *old = data;
n_alloc = n_alloc*5/4+30; // grow by over 25% grow_by_size(data, n_alloc, 30, sizeof(proc_t));
data = xrealloc(data,sizeof(proc_t)*n_alloc);
// have to move tmp too // have to move tmp too
tmp = data+(tmp-old); tmp = data+(tmp-old);
memset(data+n_used, 0, sizeof(proc_t)*(n_alloc-n_used)); memset(data+n_used, 0, sizeof(proc_t)*(n_alloc-n_used));
} }
if(n_task_alloc == n_task){ if(n_task_alloc == n_task){
//proc_t **old = ttab; //proc_t **old = ttab;
n_task_alloc = n_task_alloc*5/4+1; // grow by over 25% grow_by_size(ttab, n_task_alloc, 1, sizeof(proc_t*));
ttab = xrealloc(ttab,sizeof(proc_t*)*n_task_alloc);
} }
t = readtask_direct(PT, tmp, data+n_used); t = readtask_direct(PT, tmp, data+n_used);
if(!t) break; if(!t) break;
@ -1599,8 +1613,8 @@ proc_data_t *readproctab2(int(*want_proc)(proc_t *buf), int(*want_task)(proc_t *
pd.n = n_proc; pd.n = n_proc;
} }
// change array indexes to pointers // change array indexes to pointers
while(n_proc--) ptab[n_proc] = data+(long)(ptab[n_proc]); while(n_proc--) ptab[n_proc] = data+(uintptr_t)(ptab[n_proc]);
while(n_task--) ttab[n_task] = data+(long)(ttab[n_task]); while(n_task--) ttab[n_task] = data+(uintptr_t)(ttab[n_task]);
return &pd; return &pd;
} }
@ -1609,14 +1623,13 @@ proc_data_t *readproctab2(int(*want_proc)(proc_t *buf), int(*want_task)(proc_t *
proc_data_t *readproctab3 (int(*want_task)(proc_t *buf), PROCTAB *restrict const PT) { proc_data_t *readproctab3 (int(*want_task)(proc_t *buf), PROCTAB *restrict const PT) {
static proc_data_t pd; static proc_data_t pd;
proc_t **tab = NULL; proc_t **tab = NULL;
unsigned n_alloc = 0; size_t n_alloc = 0;
unsigned n_used = 0; size_t n_used = 0;
proc_t *p = NULL; proc_t *p = NULL;
for (;;) { for (;;) {
if (n_alloc == n_used) { if (n_alloc == n_used) {
n_alloc = n_alloc*5/4+30; // grow by over 25% grow_by_size(tab, n_alloc, 30, sizeof(proc_t*));
tab = xrealloc(tab,sizeof(proc_t*)*n_alloc);
} }
// let this next guy allocate the necessary proc_t storage // let this next guy allocate the necessary proc_t storage
// (or recycle it) since he can't tolerate realloc relocations // (or recycle it) since he can't tolerate realloc relocations