From cbadf77834e145d42ff9805694c4fccd44df7f8b Mon Sep 17 00:00:00 2001 From: Domagoj Stolfa Date: Sat, 27 Mar 2021 14:04:12 -0400 Subject: libctf: Fix an out-of-bounds read in ctf_lookup_by_name() When prefixes such as struct, union, etc. are compared with the current type (e.g. struct foo), a comparison is made with the prefix. The code currently assumes that every type is a valid C type with a prefix, however at times, garbage ends up in this function causing an unpredictable crash with DTrace due to the isspace(*p) call or subsequent calls. An example that I've seen of this is the letter 's' being passed in, comparing true with struct as the comparison size was (q - p) == 1, but then we increment p with the length of "struct", resulting in an out of bounds read. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D29435 (cherry picked from commit 410556f1f10fd35b350102725fd8504c3cb0afc8) --- cddl/contrib/opensolaris/common/ctf/ctf_lookup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'cddl') diff --git a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c b/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c index aa58663309b6..5912cc1a36e8 100644 --- a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c +++ b/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c @@ -132,8 +132,9 @@ ctf_lookup_by_name(ctf_file_t *fp, const char *name) continue; /* skip qualifier keyword */ for (lp = fp->ctf_lookups; lp->ctl_prefix != NULL; lp++) { - if (lp->ctl_prefix[0] == '\0' || - strncmp(p, lp->ctl_prefix, (size_t)(q - p)) == 0) { + if ((size_t)(q - p) >= lp->ctl_len && + (lp->ctl_prefix[0] == '\0' || + strncmp(p, lp->ctl_prefix, (size_t)(q - p)) == 0)) { for (p += lp->ctl_len; isspace(*p); p++) continue; /* skip prefix and next ws */ -- cgit v1.2.3