[Bug nptl/29755] New: pthread_getname_np() have out-of-bounds memory access

[Bug nptl/29755] New: pthread_getname_np() have out-of-bounds memory access

[zhuorong.lin at outlook dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29755

            Bug ID: 29755
           Summary: pthread_getname_np() have out-of-bounds memory access
           Product: glibc
           Version: 2.34
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: nptl
          Assignee: unassigned at sourceware dot org
          Reporter: zhuorong.lin at outlook dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

When the return value of buf is n = 0, the following buf[n-1] will
out-of-bounds memory access


#define FMT "/proc/self/task/%u/comm"
  char fname[sizeof (FMT) + 8];
  sprintf (fname, FMT, (unsigned int) pd->tid);

  int fd = __open64_nocancel (fname, O_RDONLY);
  if (fd == -1)
    return errno;

  int res = 0;
  ssize_t n = TEMP_FAILURE_RETRY (__read_nocancel (fd, buf, len)); // if n == 0
  if (n < 0)
    res = errno;
  else
    {
      if (buf[n - 1] == '\n') // out-of-bounds memory access
        buf[n - 1] = '\0';
      else if (n == len)
        res = ERANGE;
      else
        buf[n] = '\0';
    }

  __close_nocancel_nostatus (fd);

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/29755] pthread_getname_np() have out-of-bounds memory access

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29755

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
I think the kernel guarantees that /comm is never empty.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/29755] pthread_getname_np() have out-of-bounds memory access

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29755

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/29755] pthread_getname_np() have out-of-bounds memory access

[zhuorong.lin at outlook dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29755

--- Comment #2 from lin zhuorong <zhuorong.lin at outlook dot com> ---
Are you sure?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/29755] pthread_getname_np() have out-of-bounds memory access

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29755

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg

--- Comment #3 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
Even if kernel that guarantees is not empty, I still think it should fix it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.