linux-kernel - Re: [PATCH] [perf] lsdir_bid_tail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200624125042.GB2719003@krava>
Date:   Wed, 24 Jun 2020 14:50:42 +0200
From:   Jiri Olsa <jolsa@...hat.com>
To:     Gaurav Singh <gaurav1086@...il.com>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Namhyung Kim <namhyung@...nel.org>,
        "open list:PERFORMANCE EVENTS SUBSYSTEM" 
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] [perf] lsdir_bid_tail_filter: fix index check

On Tue, Jun 23, 2020 at 09:35:22PM -0400, Gaurav Singh wrote:
> Check bounds before accessing d->d_name[].
> 
> Signed-off-by: Gaurav Singh <gaurav1086@...il.com>
> ---
>  tools/perf/util/build-id.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
> index c076fc7fe025..8c35cbe93f10 100644
> --- a/tools/perf/util/build-id.c
> +++ b/tools/perf/util/build-id.c
> @@ -431,7 +431,7 @@ static bool lsdir_bid_tail_filter(const char *name __maybe_unused,
>  				  struct dirent *d)
>  {
>  	int i = 0;
> -	while (isxdigit(d->d_name[i]) && i < SBUILD_ID_SIZE - 3)
> +	while (i < SBUILD_ID_SIZE - 3 && isxdigit(d->d_name[i]))

hum, I guess it looks better, but technicaly this is not a problem right?

isxdigit will return false on zero byte which is always present in d->d_name
so it will never get out of bounds

jirka

>  		i++;
>  	return (i == SBUILD_ID_SIZE - 3) && (d->d_name[i] == '\0');
>  }
> -- 
> 2.17.1
>