freebsd-dev/cddl
Domagoj Stolfa 410556f1f1 libctf: Fix an out-of-bounds read in ctf_lookup_by_name()
When prefixes such as struct, union, etc. are compared with the current
type (e.g. struct foo), a comparison is made with the prefix.  The code
currently assumes that every type is a valid C type with a prefix,
however at times, garbage ends up in this function causing an
unpredictable crash with DTrace due to the isspace(*p) call or
subsequent calls. An example that I've seen of this is the letter 's'
being passed in, comparing true with struct as the comparison size was
(q - p) == 1, but then we increment p with the length of "struct",
resulting in an out of bounds read.

Reviewed by:	markj
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D29435
2021-03-27 14:04:12 -04:00
..
compat/opensolaris Merge OpenZFS support in to HEAD. 2020-08-25 02:21:27 +00:00
contrib/opensolaris libctf: Fix an out-of-bounds read in ctf_lookup_by_name() 2021-03-27 14:04:12 -04:00
lib pkgbase: Move libicp in utilities 2021-03-16 07:12:40 +01:00
sbin zfs: bump version and install new share files 2021-02-18 15:21:10 +01:00
share Install links for zpool feature compat aliases 2021-02-25 14:16:09 -05:00
tests Merge ^/user/ngie/release-pkg-fix-tests to unbreak how test files are installed 2016-05-04 23:20:53 +00:00
usr.bin build: remove LIBPTHREAD/LIBTHR build options 2021-01-22 12:33:27 -06:00
usr.sbin build: remove LIBPTHREAD/LIBTHR build options 2021-01-22 12:33:27 -06:00
Makefile zfs: bump version and install new share files 2021-02-18 15:21:10 +01:00
Makefile.inc Do a sweep and remove most WARNS=6 settings 2020-10-01 01:10:51 +00:00