Messages in this thread Patch in this message | | | From | Vince Weaver <> | Date | Tue, 23 Jul 2019 16:42:30 -0400 (EDT) | Subject | [patch] perf tool buffer overflow in perf_header__read_build_ids |
| |
Hello
my perf_tool_fuzzer has found another issue, this one a buffer overflow in perf_header__read_build_ids. The build id filename is read in with a filename length read from the perf.data file, but this can be longer than PATH_MAX which will smash the stack.
This might not be the right fix, not sure if filename should be NUL terminated or not.
Signed-off-by: Vince Weaver <vincent.weaver@maine.edu>
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index c24db7f4909c..9a893a26e678 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -2001,6 +2001,9 @@ static int perf_header__read_build_ids(struct perf_header *header, perf_event_header__bswap(&bev.header); len = bev.header.size - sizeof(bev); + + if (len>PATH_MAX) len=PATH_MAX; + if (readn(input, filename, len) != len) goto out; /*
| |