Both functions read an attacker-controlled size directly from the input file and pass size + 1 to malloc() before reading size bytes into the result:
read_ftrace_printk(): size is an unsigned int from read4(). When size == UINT_MAX, size + 1 overflows to 0, so malloc(0) returns a minimal allocation while size itself remains UINT_MAX. read_saved_cmdline(): size is an unsigned long long from read8(). When size == ULLONG_MAX, size + 1 overflows to 0 the same way. In both cases, do_read(buf, size) then attempts to read the full, unwrapped size into the tiny allocated buffer, a heap buffer overflow. This was previously masked by do_read()'s size parameter being 'int': passing these values truncated them, which the read() syscall's own boundary checks rejected before any data was read. Fixing that truncation (widening do_read() to size_t) is correct on its own, but it removes this accidental protection and exposes the pre-existing missing bounds check in both functions. Reject the one value that causes the overflow before it's used, in each function. Signed-off-by: Tanushree Shah <[email protected]> --- tools/perf/util/trace-event-read.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c index 52ed496d92c3..53f1920c3fcb 100644 --- a/tools/perf/util/trace-event-read.c +++ b/tools/perf/util/trace-event-read.c @@ -15,6 +15,7 @@ #include <fcntl.h> #include <unistd.h> #include <errno.h> +#include <limits.h> #include "trace-event.h" #include "debug.h" @@ -180,6 +181,11 @@ static int read_ftrace_printk(struct tep_handle *pevent) if (!size) return 0; + if (size == UINT_MAX) { + pr_debug("invalid ftrace printk size\n"); + return -1; + } + buf = malloc(size + 1); if (buf == NULL) return -1; @@ -357,6 +363,11 @@ static int read_saved_cmdline(struct tep_handle *pevent) if (!size) return 0; + if (size == ULLONG_MAX) { + pr_debug("invalid saved cmdline size"); + return -1; + } + buf = malloc(size + 1); if (buf == NULL) { pr_debug("memory allocation failure\n"); -- 2.47.3
