d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

savecore(8): Fix buffer overrun inspecting disks with varying sector size

Browse Source 
A premature optimization lead to caching a native-sector sized memory
allocation.  If the program examined a 512 byte sector disk, then a 4096
byte sector disk, the program would overrun the cached 512 byte buffer.

Just remove the optimization to fix the bug.  This was introduced with the 4Kn
dump support in r298076.

Reported by:	markj
Reviewed by:	markj, rpokala
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D8162
This commit is contained in:
cem 2016-10-06 05:16:44 +00:00
parent 8906b1321f
commit 44e4206520
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sbin/savecore/savecore.c
View File

@ -436,7 +436,8 @@ DoFile(const char *savedir, const char *device)
{
xo_handle_t *xostdout, *xoinfo;
static char infoname[PATH_MAX], corename[PATH_MAX], linkname[PATH_MAX];
static char *buf = NULL, *temp = NULL;
static char *buf = NULL;
char *temp = NULL;
struct kerneldumpheader kdhf, kdhl;
off_t mediasize, dumpsize, firsthd, lasthd;
FILE *info, *fp;
@ -498,12 +499,10 @@ DoFile(const char *savedir, const char *device)
}
lasthd = mediasize - sectorsize;
temp = malloc(sectorsize);
if (temp == NULL) {
temp = malloc(sectorsize);
if (temp == NULL) {
syslog(LOG_ERR, "%m");
goto closefd;
}
syslog(LOG_ERR, "%m");
goto closefd;
}
if (lseek(fd, lasthd, SEEK_SET) != lasthd ||
read(fd, temp, sectorsize) != (ssize_t)sectorsize) {
@ -749,6 +748,7 @@ nuke:
}
xo_close_container_h(xostdout, "crashdump");
xo_finish_h(xostdout);
free(temp);
close(fd);
return;
@ -756,6 +756,7 @@ closeall:
fclose(fp);
closefd:
free(temp);
close(fd);
}