Ridiculously high -s arguments could trigger an integer overflow and
result in less memory allocated than desired and in turn a heap overflow
and crash. Or at least annoy valgrind:
$ valgrind -q strace -o /dev/null -s6553600000 -f uname
==14212== Warning: silly arg (-2147483648) to malloc()
---
util.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/util.c b/util.c
index c28edf3..9d3e195 100644
--- a/util.c
+++ b/util.c
@@ -40,6 +40,7 @@
#include <sys/user.h>
#include <sys/param.h>
#include <fcntl.h>
+#include <limits.h>
#if HAVE_SYS_UIO_H
#include <sys/uio.h>
#endif
@@ -596,7 +597,7 @@ printstr(struct tcb *tcp, long addr, int len)
/* Allocate static buffers if they are not allocated yet. */
if (!str)
str = malloc(max_strlen + 1);
- if (!outstr)
+ if (!outstr && (INT_MAX - sizeof "\"...\"") / 4 > max_strlen)
outstr = malloc(4 * max_strlen + sizeof "\"...\"");
if (!str || !outstr) {
fprintf(stderr, "out of memory\n");
--
1.7.3
------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________
Strace-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/strace-devel
