Jim Warner
a45dace4b8
library: utility buffers now immune to buffer overflow
A recent Debian bug report, dealing with release 3.2.8 and its even more restrictive buffer sizes (1024) used in stat, statm and status reads via file2str calls, is a reminder of what could yet happen to procps-ng. Size needs are determined by kernel evolution and/or config options so that bug could resurface even though buffer size is currently 4 times the old procps-3.2.8 limits. Those sizes were raised from 1024 to 4096 bytes in the patch submitted by Eric Dumazet, and referenced below. This patch makes libprocps immune to future changes in the amount of stuff that is ultimately found in a proc 'stat', 'statm' or 'status' subdirectory. We now trade the former static buffer of 4096 bytes for dynamically allocated buffers whose size can be increased by need. Even though this change is solely an internal one, and in no way directly affects the API or the ABI, libtool suggests that the LIBprocps_REVISION be raised. I hope Craig remembers to do that just before a next release. We don't want a repeat of the procps-ng-3.3.4 boo-boo, but with no API/ABI impact that probably can't happen. p.s. A big thanks to Jaromir Capik <jcapik@redhat.com> who reviewed my original version and, of course, found some of my trademark illogic + unnecessary code. After his coaxing, he helped make this a much better commit. Reference(s): . procps-3.2.8 http://bugs.debian.org/702965 . allow large list of groups commit 7933435584aa1fd75460f4c7715a3d4855d97c1c Signed-off-by: Jim Warner <james.warner@comcast.net> Reviewed by: Jaromir Capik <jcapik@redhat.com>
COMPATIBILITY This code is intended for use with Linux 2.6.xx, 3.x and hopefully all future kernels. INSTALLATION If you are using git version of the project you need extra step. ./autogen.sh After that, and everyone using .tar.xz version of procps-ng, can do normal build. Read './configure --help' to select options for your needs. ./configure make make install If you have DejaGNU installed you can run optional test suite. make check HOW TO CONTRIBUTE See Documentation/BUGS file. PACKAGING If you are a downstream maintainer (packager) for a Linux distribution, please avoid causing troubles. This section applies to you. Avoid maintaining distribution specific patches. Send your patches to upstream, where they are at least reviewed, if not included. Please forward bug reports. If your bug database is public and busy enough to bother with, please make this known. Follow Debian's lead in making the bug database easy to comment on via email without need for an account. For normal packages, ensure that you do not add debugging flags to the CFLAGS variable. UPSTREAM & BUG REPORTS procps-ng <procps@freelists.org>
Description
Command line and full screen utilities for browsing procfs, a "pseudo" file system dynamically generated by Linux to provide information about the status of entries in its process table.
Languages
C
97.2%
Makefile
1%
Shell
0.9%
M4
0.9%