Hello

my perf_tool_fuzzer has found another issue, this one a buffer overflow
in perf_header__read_build_ids.  The build id filename is read in with a 
filename length read from the perf.data file, but this can be longer than
PATH_MAX which will smash the stack.

This might not be the right fix, not sure if filename should be NUL
terminated or not.

Signed-off-by: Vince Weaver <vincent.wea...@maine.edu>

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index c24db7f4909c..9a893a26e678 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2001,6 +2001,9 @@ static int perf_header__read_build_ids(struct perf_header 
*header,
                        perf_event_header__bswap(&bev.header);
 
                len = bev.header.size - sizeof(bev);
+
+               if (len>PATH_MAX) len=PATH_MAX;
+
                if (readn(input, filename, len) != len)
                        goto out;
                /*

Reply via email to