On Sun, 26 Jul 2026 00:19:48 +0530, Tanushree Shah wrote: > This series fixes five security issues in trace-event-read.c and > trace-event.c: > 1. Stack buffer overflow in read_string() when a string exceeds > BUFSIZ, due to a missing bounds check. > 2. Integer truncation when passing 64-bit sizes into do_read() and > skip(), which use 'int' parameters, causing uninitialized memory > to be dumped and parsers to read out of bounds. > 3. Double free / use-after-free in trace_event__cleanup(): it frees > t->pevent but never clears the pointer, so calling it twice on > the same trace_event touches already-freed memory. Also fixes a > related leak in trace_event__init(), which overwrites > t->pevent/t->plugin_list without releasing any existing handle > if called more than once on the same struct. > 4. Heap buffer overflow in read_ftrace_printk() and > read_saved_cmdline(): size + 1 can overflow to 0 in malloc(), > allocating a tiny buffer while a huge read is still attempted > into it. > 5. Infinite loop in skip(): it does not check do_read()'s return > value, so a crafted size can spin the loop indefinitely. > > [...] Applied to perf-tools-next, thanks!
Best regards, Namhyung
