linux-kernel - Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAK7LNATLCAnrtqR8vv=jWiDcODGchMekOGMbSNvEQtnb3JqTDQ@mail.gmail.com>
Date:   Wed, 12 Feb 2020 18:20:42 +0900
From:   Masahiro Yamada <masahiroy@...nel.org>
To:     Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>
Cc:     youling257 <youling257@...il.com>, Pavel Machek <pavel@....cz>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run

On Tue, Feb 11, 2020 at 1:19 AM Masahiro Yamada <masahiroy@...nel.org> wrote:
>
> scripts/kallsyms crashes because memcpy() writes one more byte than
> allocated.
>
> Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)")
> Reported-by: youling257 <youling257@...il.com>
> Reported-by: Pavel Machek <pavel@....cz>
> Signed-off-by: Masahiro Yamada <masahiroy@...nel.org>
> ---

Applied.
I will send a pull request shortly
because many people are tripping over this bug.




>  scripts/kallsyms.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
> index a566d8201b56..0133dfaaf352 100644
> --- a/scripts/kallsyms.c
> +++ b/scripts/kallsyms.c
> @@ -210,7 +210,7 @@ static struct sym_entry *read_symbol(FILE *in)
>
>         len = strlen(name) + 1;
>
> -       sym = malloc(sizeof(*sym) + len);
> +       sym = malloc(sizeof(*sym) + len + 1);
>         if (!sym) {
>                 fprintf(stderr, "kallsyms failure: "
>                         "unable to allocate required amount of memory\n");
> @@ -219,7 +219,7 @@ static struct sym_entry *read_symbol(FILE *in)
>         sym->addr = addr;
>         sym->len = len;
>         sym->sym[0] = type;
> -       memcpy(sym_name(sym), name, len);
> +       strcpy(sym_name(sym), name);
>         sym->percpu_absolute = 0;
>
>         return sym;
> --
> 2.17.1
>


-- 
Best Regards
Masahiro Yamada