From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gnu.wildebeest.org (wildebeest.demon.nl [212.238.236.112]) by sourceware.org (Postfix) with ESMTPS id BDADF386F447 for ; Tue, 16 Jun 2020 22:26:02 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org BDADF386F447 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=klomp.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=mark@klomp.org Received: from tarox.wildebeest.org (tarox.wildebeest.org [172.31.17.39]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by gnu.wildebeest.org (Postfix) with ESMTPSA id 897D5317FC17; Wed, 17 Jun 2020 00:25:59 +0200 (CEST) Received: by tarox.wildebeest.org (Postfix, from userid 1000) id 2FE38402412E; Wed, 17 Jun 2020 00:25:58 +0200 (CEST) From: Mark Wielaard To: elfutils-devel@sourceware.org Cc: Mark Wielaard Subject: [PATCH 09/10] debuginfod: Fix build_id hexadecimal length check. Date: Wed, 17 Jun 2020 00:25:38 +0200 Message-Id: <20200616222539.29109-9-mark@klomp.org> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20200616222539.29109-1-mark@klomp.org> References: <20200616222539.29109-1-mark@klomp.org> X-Spam-Status: No, score=-12.5 required=5.0 tests=BAYES_00, GIT_PATCH_0, JMQ_SPF_NEUTRAL, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jun 2020 22:26:03 -0000 When is debuginfod_query_server is given an hexadecimal string as build-id build_id_len will be zero. We were checking the size of the build_id_bytes destination string instead of the string length of build_id input string. Make sure the input string is not too big or strcpy might overwrite then end of the build_id_bytes array. Signed-off-by: Mark Wielaard --- debuginfod/ChangeLog | 5 +++++ debuginfod/debuginfod-client.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/debuginfod/ChangeLog b/debuginfod/ChangeLog index 9ff2e111..d6bbfac8 100644 --- a/debuginfod/ChangeLog +++ b/debuginfod/ChangeLog @@ -1,3 +1,8 @@ +2020-06-16 Mark Wielaard + + * debuginfod-client.c (debuginfod_query_server): Replace sizeof + build_id_bytes check with strlen build_id check. + 2020-06-16 Mark Wielaard * debuginfod-client.c (debuginfod_query_server): Increase suffix diff --git a/debuginfod/debuginfod-client.c b/debuginfod/debuginfod-client.c index e9c2ca83..7b53cb31 100644 --- a/debuginfod/debuginfod-client.c +++ b/debuginfod/debuginfod-client.c @@ -496,7 +496,7 @@ debuginfod_query_server (debuginfod_client *c, /* Copy lowercase hex representation of build_id into buf. */ if ((build_id_len >= MAX_BUILD_ID_BYTES) || (build_id_len == 0 && - sizeof(build_id_bytes) > MAX_BUILD_ID_BYTES*2 + 1)) + strlen ((const char *) build_id) > MAX_BUILD_ID_BYTES*2)) return -EINVAL; if (build_id_len == 0) /* expect clean hexadecimal */ strcpy (build_id_bytes, (const char *) build_id); -- 2.18.4