Commit Graph

2325 Commits

Author SHA1 Message Date
Jim Warner
12b0b5b2cf top: refactored some more peripheral 'inspect' support
These modifications are being made now in anticipation
of some coming 'other filter' config file changes. Our
entries must be written last to the rc file since that
is where the users have been told to 'echo' additions.

Therefore, that 'config_insp' function must be adapted
to anticipate a passed buffer that was already primed.

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-26 21:25:17 +10:00
Jim Warner
5e8bf3c028 top: refactored some of that 'other filtering' support
If we are to support preserving 'other filter' entries
in the rcfile, then the current logic setting up those
osel entries for a WIN_t must be shareable for startup
and when interacting with a user. So, this commit just
repositions this current code in a shareable function.

[ along the way, we give the prior guy a proper name ]

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-26 21:25:17 +10:00
Jim Warner
016f10cb93 top: reposition some of that 'other filtering' support
When we get around to saving that 'Other Filter' stuff
in the rcfile, we'll need access to the Fieldstab plus
the justify_pad() function. So this commit repositions
two 'osel' functions in anticipation of adding 1 more.

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-26 21:25:17 +10:00
Jim Warner
8398b7d9b0 top: refactor some of that configuration files support
The 'config_file()' function was getting a little long
in the tooth, so this commit simply renames/rearranges
some stuff anticipating 'other filters' in the rcfile.

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-26 21:25:17 +10:00
Jim Warner
567a9b6240 top: let's honor <Esc> key on color mapping screen too
Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-26 21:25:17 +10:00
Jim Warner
775223a817 top: make rcfile duplicate fields check more efficient
Jeeze, there was no need to employ *both* strchr() and
strrchr() when ensuring fields hadn't been duplicated.

So let's avoid one of those function calls completely.

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-26 21:25:17 +10:00
Qualys Security Advisory
7e55bff63b 0125-vmstat: Prevent out-of-bounds writes in new_header() and diskheader().
This does not happen with the default string (" -----timestamp-----"),
but this string is translated (to unknown lengths).

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
aca26df501 0124-vmstat: Check return values of localtime() and strftime().
Otherwise it leads to NULL-pointer dereferences (in case of localtime()
errors) and indeterminate contents of timebuf (in case of strftime()
errors).

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
c7e17f4439 0123-vmstat: Replace memcmp() with strncmp().
Otherwise this may read out-of-bounds (there is no guarantee that 5
bytes are actually available at partition/optarg).

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
e37e4528d0 0122-vmstat: getopt*() returns -1 when done, not EOF.
Luckily, EOF is usually -1, but this is not guaranteed by the standard.

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
eaec2d0977 0121-w: Clamp maxcmd to the MIN/MAX_CMD_WIDTH range.
The current checks allow out-of-range values (for example, if
getenv/atoi returns ~-2GB, maxcmd becomes ~+2GB after the subtraction).
This is not a security problem, none of this is under an attacker's
control.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
e24804a9de 0120-w: Prevent out-of-bounds reads in print_display_or_interface().
They occur if disp or tmp reaches host + len: add checks. Also, constify
everything.
2018-06-23 21:59:14 +10:00
Craig Small
e9172d0484 misc: Tell po4a to handle email macros
References:
 https://www.freelists.org/post/procps/newlib-Qualys-patches
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
7bc4779718 0095-pmap: Fix extended mode in one_proc().
Check the return value of sscanf() to make sure that all input items are
properly initialized.

In extended mode (x_option), one_proc() loads the values of start and
perms during one iteration of the while loop, and displays them during
one of the following iterations, but start and perms are variables local
to the while loop: move them out of the while loop, to the beginning of
the function.

Also, display a mapping only if cp2 is properly initialized; otherwise
(for example), mappings that do not belong to a selected range are
displayed, and with a NULL mapping name:

$ pmap -x -A 6FFF00000000,7FFF00000000 $$
...
Address           Kbytes     RSS   Dirty Mode  Mapping
000055b3d1e9b000       0     912       0  r-xp (null)
000055b3d2194000       0      16      16  r--p (null)
000055b3d2198000       0      36      36  rw-p (null)
...

Removed const as this causes problems elsewhere.

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
7d3b4bcaf2 0093-pmap: Remove dead code in mapping_name().
If "cp = strrchr(mapbuf_b, '/')" then this function returns, and
otherwise there is no '/' in mapbuf_b and "cp = strchr(mapbuf_b, '/')"
is always false: remove this second block, since it is never entered.
Also, constify a few things in this function.

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
991b41cb32 0092-pmap: Harden one_proc().
Replace sprintf() with snprintf().

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
550a2a21f9 0091-pmap: Check sscanf() in discover_shm_minor().
Need at least 6 items ("inode" is unused).

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
2119cd3dd5 0090-pmap: Fix output format of VmFlags.
In the headers, the space was misplaced; for example, "pmap -XX $$"
outputs "VmFlagsMapping" (without a space). Use justify_print() instead
of printf().

There was also an extra space in the output, because vmflags[] (from the
"VmFlags:" line) always ends with a space. Overwriting this last space
with a null byte fixes this misalignment.

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
7e2bd279ed 0089-pmap: Prevent buffer overflow in sscanf().
vmflags[] is a 27*(2+1)=81 char array, but there are 30 flags now (not
27), and even with 27 flags this was an off-by-one overflow (the kernel
always outputs a flag with "%c%c ", so the last +1 is for a space, not
for the terminating null byte). Protect vmflags[] with a maximum field
width, as in the surrounding sscanf() calls.

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
5f654f143a 0088-pmap: Always check the return value of fgets().
Otherwise "the contents of the array remain unchanged and a null pointer
is returned" or "the array contents are indeterminate and a null pointer
is returned".

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
45f81ef706 0087-pmap: Fix parsing error in config_read().
$ echo '[' > crash
$ pmap -C crash $$
Segmentation fault (core dumped)

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
bf409f92fd 0086-pmap: Prevent integer overflow in main().
Unlikely to ever happen, but just in case.

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
105ab093b8 0085-pmap.c: Plug memory leak in range_arguments().
Also, simplify the code slightly (but functionally equivalent). Check
the return value of xstrdup() only once (yes, it can return NULL).

Adapted slightly to remove goto and leave the format of checks the same.
A lot of the fixes were already in newlib, caught by coverity

References:
 commit 25f655891f

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
a016a43b53 0027-skill: Prevent multiple overflows in ENLIST().
First problem: saved_argc was used to calculate the size of the array,
but saved_argc was never initialized. This triggers an immediate heap-
based buffer overflow:

$ skill -c0 -c0 -c0 -c0
Segmentation fault (core dumped)

Second problem: saved_argc was not the upper bound anyway, because one
argument can ENLIST() several times (for example, in parse_namespaces())
and overflow the array as well.

Third problem: integer overflow of the size of the array.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
3f75d105b9 0026-skill: Fix double-increment of pid_count.
No need to "pid_count++;" because "ENLIST(pid," does it already. Right
now this can trigger a heap-based buffer overflow.

Also, remove the unneeded "pid_count = 0;" (it is static, and
skillsnice_parse() is called only once; and the other *_count variables
are not initialized explicitly either).
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
18efff2a1f 0024-skill: Always NULL-terminate argv.
The memmove() itself does not move the NULL-terminator, because nargs is
decremented first. Copy how skill_sig_option() does it: decrement nargs
last, and remove the "if (nargs - i)" (we are in "while (i < nargs)").
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
fa7ea000ce 0023-skill: Fix getline() usage.
man getline: "If *lineptr is set to NULL and *n is set 0 before the
call, then getline() will allocate a buffer for storing the line. This
buffer should be freed by the user program even if getline() failed."
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
c704460c7d 0022-skill: Simplify the kill_main() loop.
Right now the "loop=0; break;" is never reached.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
f69d54f05b 0021-pwdx: Fix a misleading comment.
It sounds like an off-by-one, but the code itself is correct.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
73008f26ea 0020-pidof: Prevent integer overflows with grow_size().
Note: unlike "size" and "omit_size", "path_alloc_size" is not multiplied
by "sizeof(struct el)" but the checks in grow_size() allow for a roughly
100MB path_alloc_size, which should be more than enough for readlink().
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
4abe4a51a0 0019-pidof: Do not memleak pidof_root if multiple -c options. 2018-06-23 21:59:14 +10:00
Qualys Security Advisory
55fac85bf0 0018-pidof: Do not skip the NULL terminator in cmdline.
This should never happen (cmdline[0] should always be non-NULL), but
just in case.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
9d59bd6fc9 0017-pidof: Get the arg1 base name with get_basename().
Same as program_base, cmd_arg0base, and exe_link_base.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
cd8499f5f0 0015-tload: Prevent integer overflows of ncols, nrows, and scr_size.
Also, use xerrx() instead of xerr() since errno is not set.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
44d5a5689c 0014-tload: Prevent a buffer overflow when row equals nrows.
When max_scale is very small, scale_fact is very small, row is equal to
nrows, p points outside screen, and the write to *p is out-of-bounds.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
44593c5e99 0013-tload: Use snprintf() instead of sprintf(). 2018-06-23 21:59:14 +10:00
Qualys Security Advisory
39c3542754 0012-tload: Call longjmp() 1 instead of 0.
Do it explicitly instead of the implicit "longjmp() cannot cause 0 to be
returned. If longjmp() is invoked with a second argument of 0, 1 will be
returned instead."
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
fdc2af1114 0011-tload: Use standard names instead of numbers. 2018-06-23 21:59:14 +10:00
Qualys Security Advisory
27fbb21128 0009-uptime: Check the return value of various functions. 2018-06-23 21:59:14 +10:00
Qualys Security Advisory
df0e1a13ab 0007-pgrep: Always null-terminate the cmd*[] buffers.
Otherwise, man strncpy: "If there is no null byte among the first n
bytes of src, the string placed in dest will not be null-terminated."
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
8e6d11a928 0006-pgrep: Initialize the cmd*[] stack buffers.
Otherwise (for example), if the (undocumented) opt_echo is set, but not
opt_long, and not opt_longlong, and not opt_pattern, there is a call to
xstrdup(cmdoutput) but cmdoutput was never initialized:

sleep 60 & echo "$!" > pidfile
env -i LD_DEBUG=`perl -e 'print "A" x 131000'` pkill -e -c -F pidfile | xxd
...
000001c0: 4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA
000001d0: 4141 4141 4141 4141 fcd4 e6bd e47f 206b  AAAAAAAA...... k
000001e0: 696c 6c65 6420 2870 6964 2031 3230 3931  illed (pid 12091
000001f0: 290a 310a                                ).1.
[1]+  Terminated              sleep 60

(the LD_DEBUG is just a trick to fill the initial stack with non-null
bytes, to show that there is uninitialized data from the stack in the
output; here, an address "fcd4 e6bd e47f")
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
ac85587773 0005-pgrep: Simplify the match_*() functions. 2018-06-23 21:59:14 +10:00
Qualys Security Advisory
8e3e77910d 0004-pgrep: Replace buf+1 with buf in read_pidfile().
Unless we missed something, this makes it unnecessarily difficult to
read/audit.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
9cfc1b8c1f 0003-pgrep: Replace ints with longs in strict_atol().
atol() means long, and value points to a long.
2018-06-23 21:59:14 +10:00
Qualys Security Advisory
7c9a7d7cfe 0002-pgrep: Prevent integer overflow of list size.
Not exploitable (not under an attacker's control), but still a potential
non-security problem. Copied, fixed, and used the grow_size() macro from
pidof.c.

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-06-23 21:59:14 +10:00
Jim Warner
80f9815f5f top: a tweak to the recent 256-color termninal support
We now use the actual terminfo 'max_colors' value with
the 'color mapping' screen, not that hard coded '256'.

Reference(s):
https://gitlab.com/procps-ng/procps/issues/96

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-09 21:45:38 +10:00
Jim Warner
5705866fb6 top: treat all of those vertical scroll keys uniformly
When not displaying all tasks (the 'i' toggle is off),
the concept of vertical scrolling has no real meaning.

However, only 2 keys (up/down) impacting that vertical
position were currently being disabled with this mode.

This patch will extend such treatment to the following
additional vertical impact keys: pgup,pgdn,home & end.

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-09 21:45:38 +10:00
Jim Warner
19ec80bd41 top: force return to row 1 for thread mode transitions
This program does a good job of policing that vertical
scrolled position, ensuring that total tasks are never
exceeded. However, during transitions from thread mode
to normal task mode (the 'H' toggle) that wasn't true.

And while there was no real harm done, it did make the
use of up/down arrow keys "appear" disabled especially
if that scroll message was not displayed ('C' toggle).

This patch simply forces a return to row #1 whenever a
user toggles that display between thread & task modes.

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-09 21:45:38 +10:00
Jim Warner
c3323bdb68 top: fix 'iokey()' flaw preventing proper translations
As it turns out, the very first entry in the 'iokey()'
tinfo_tab was preventing the proper translation of the
simulated PgUp/PgDn keys (ctrl+meta+k/j). Ignoring the
tortured history behind the most recent change to that
entry, this patch restores the previous value and once
again properly translates these particular keystrokes.

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-06-09 21:45:38 +10:00
Qualys Security Advisory
6cf89d5065 0067-ps/sortformat.c: Avoid "sep_loc + 1" when sep_loc is NULL. 2018-06-09 21:45:38 +10:00