From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from vmicros1.altlinux.org (vmicros1.altlinux.org [194.107.17.57]) by sourceware.org (Postfix) with ESMTP id BF28B3857C6A for ; Thu, 18 Nov 2021 22:04:40 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org BF28B3857C6A Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=altlinux.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=altlinux.org Received: from mua.local.altlinux.org (mua.local.altlinux.org [192.168.1.14]) by vmicros1.altlinux.org (Postfix) with ESMTP id CA01C72C8B8; Fri, 19 Nov 2021 01:04:39 +0300 (MSK) Received: by mua.local.altlinux.org (Postfix, from userid 508) id B6DFD7CC8BC; Fri, 19 Nov 2021 01:04:39 +0300 (MSK) Date: Fri, 19 Nov 2021 01:04:39 +0300 From: "Dmitry V. Levin" To: Matthias Maennich Cc: elfutils-devel@sourceware.org, kernel-team@android.com, Paul Pluzhnikov Subject: Re: [PATCH] dwfl: fix potential overflow when reporting on kernel modules Message-ID: <20211118220439.GA2074@altlinux.org> References: <20211118194449.1931428-1-maennich@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20211118194449.1931428-1-maennich@google.com> X-Spam-Status: No, score=-12.6 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Nov 2021 22:04:43 -0000 On Thu, Nov 18, 2021 at 07:44:50PM +0000, Matthias Maennich via Elfutils-devel wrote: > dwfl_linux_kernel_report_modules_ has an outstanding ancient bug when > reading kernel module information from a modules list file. The target > buffer for the module name was sized too small to hold potential values. > Fix that by increasing the value to account for the null termination. > > In practice, this unlikely ever happened, but it now got diagnosed by > LLVM as part of a stricter -Wfortify-source implementation [1]: > > libdwfl/linux-kernel-modules.c:1019:7: error: 'sscanf' may overflow; destination buffer in argument 3 has size 128, but the corresponding specifier may require size 129 [-Werror,-Wfortify-source] > modname, &modsz, &modaddr) == 3) > > [1] https://github.com/llvm/llvm-project/commit/2db66f8d48beeea835cb9a6940e25bc04ab5d941 > > Suggested-by: Paul Pluzhnikov > Signed-off-by: Matthias Maennich > Change-Id: I97b4fcb536273e5ccc4e37b0b9f0f8ffb7487909 > --- > libdwfl/linux-kernel-modules.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libdwfl/linux-kernel-modules.c b/libdwfl/linux-kernel-modules.c > index c0f8dfa4aef2..58c0c417a597 100644 > --- a/libdwfl/linux-kernel-modules.c > +++ b/libdwfl/linux-kernel-modules.c > @@ -1008,7 +1008,7 @@ dwfl_linux_kernel_report_modules (Dwfl *dwfl) > int result = 0; > Dwarf_Addr modaddr; > unsigned long int modsz; > - char modname[128]; > + char modname[128+1]; > char *line = NULL; > size_t linesz = 0; > /* We can't just use fscanf here because it's not easy to distinguish \n LGTM, thanks. -- ldv