path: root/cddl
diff options
authorDomagoj Stolfa <domagoj.stolfa@gmail.com>2021-03-27 18:04:12 +0000
committerMark Johnston <markj@FreeBSD.org>2021-03-27 18:04:12 +0000
commit410556f1f10fd35b350102725fd8504c3cb0afc8 (patch)
treea29ad12143a9f9692615cc07beeb1a40ea2d5e5f /cddl
parent71c160a8f614fa4812838002ba9d266af3cf988c (diff)
libctf: Fix an out-of-bounds read in ctf_lookup_by_name()
When prefixes such as struct, union, etc. are compared with the current type (e.g. struct foo), a comparison is made with the prefix. The code currently assumes that every type is a valid C type with a prefix, however at times, garbage ends up in this function causing an unpredictable crash with DTrace due to the isspace(*p) call or subsequent calls. An example that I've seen of this is the letter 's' being passed in, comparing true with struct as the comparison size was (q - p) == 1, but then we increment p with the length of "struct", resulting in an out of bounds read. Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D29435
Diffstat (limited to 'cddl')
1 files changed, 3 insertions, 2 deletions
diff --git a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c b/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c
index aa58663309b6..5912cc1a36e8 100644
--- a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c
+++ b/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c
@@ -132,8 +132,9 @@ ctf_lookup_by_name(ctf_file_t *fp, const char *name)
continue; /* skip qualifier keyword */
for (lp = fp->ctf_lookups; lp->ctl_prefix != NULL; lp++) {
- if (lp->ctl_prefix[0] == '\0' ||
- strncmp(p, lp->ctl_prefix, (size_t)(q - p)) == 0) {
+ if ((size_t)(q - p) >= lp->ctl_len &&
+ (lp->ctl_prefix[0] == '\0' ||
+ strncmp(p, lp->ctl_prefix, (size_t)(q - p)) == 0)) {
for (p += lp->ctl_len; isspace(*p); p++)
continue; /* skip prefix and next ws */