diff options
| author | Domagoj Stolfa <domagoj.stolfa@gmail.com> | 2021-03-27 18:04:12 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-03-27 18:04:12 +0000 |
| commit | 410556f1f10fd35b350102725fd8504c3cb0afc8 (patch) | |
| tree | a29ad12143a9f9692615cc07beeb1a40ea2d5e5f /cddl/contrib/opensolaris/common | |
| parent | 71c160a8f614fa4812838002ba9d266af3cf988c (diff) | |
| download | src-410556f1f10fd35b350102725fd8504c3cb0afc8.tar.gz src-410556f1f10fd35b350102725fd8504c3cb0afc8.zip | |
libctf: Fix an out-of-bounds read in ctf_lookup_by_name()
When prefixes such as struct, union, etc. are compared with the current
type (e.g. struct foo), a comparison is made with the prefix. The code
currently assumes that every type is a valid C type with a prefix,
however at times, garbage ends up in this function causing an
unpredictable crash with DTrace due to the isspace(*p) call or
subsequent calls. An example that I've seen of this is the letter 's'
being passed in, comparing true with struct as the comparison size was
(q - p) == 1, but then we increment p with the length of "struct",
resulting in an out of bounds read.
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D29435
Diffstat (limited to 'cddl/contrib/opensolaris/common')
| -rw-r--r-- | cddl/contrib/opensolaris/common/ctf/ctf_lookup.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c b/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c index aa58663309b6..5912cc1a36e8 100644 --- a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c +++ b/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c @@ -132,8 +132,9 @@ ctf_lookup_by_name(ctf_file_t *fp, const char *name) continue; /* skip qualifier keyword */ for (lp = fp->ctf_lookups; lp->ctl_prefix != NULL; lp++) { - if (lp->ctl_prefix[0] == '\0' || - strncmp(p, lp->ctl_prefix, (size_t)(q - p)) == 0) { + if ((size_t)(q - p) >= lp->ctl_len && + (lp->ctl_prefix[0] == '\0' || + strncmp(p, lp->ctl_prefix, (size_t)(q - p)) == 0)) { for (p += lp->ctl_len; isspace(*p); p++) continue; /* skip prefix and next ws */ |