d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

savecore(8): Fix buffer overrun inspecting disks with varying sector size

Browse Source 
A premature optimization lead to caching a native-sector sized memory
allocation.  If the program examined a 512 byte sector disk, then a 4096
byte sector disk, the program would overrun the cached 512 byte buffer.

Just remove the optimization to fix the bug.  This was introduced with the 4Kn
dump support in r298076.

Reported by:	markj
Reviewed by:	markj, rpokala
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D8162
This commit is contained in:
Conrad Meyer 2016-10-06 05:16:44 +00:00
parent 3595d72f86
commit 8df555925a
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sbin/savecore/savecore.c
View File

@ -436,7 +436,8 @@ DoFile(const char *savedir, const char *device)
{ {
xo_handle_t *xostdout, *xoinfo; xo_handle_t *xostdout, *xoinfo;
static char infoname[PATH_MAX], corename[PATH_MAX], linkname[PATH_MAX]; static char infoname[PATH_MAX], corename[PATH_MAX], linkname[PATH_MAX];
static char *buf = NULL, *temp = NULL; static char *buf = NULL;
char *temp = NULL;
struct kerneldumpheader kdhf, kdhl; struct kerneldumpheader kdhf, kdhl;
off_t mediasize, dumpsize, firsthd, lasthd; off_t mediasize, dumpsize, firsthd, lasthd;
FILE *info, *fp; FILE *info, *fp;
@ -498,12 +499,10 @@ DoFile(const char *savedir, const char *device)
} }
lasthd = mediasize - sectorsize; lasthd = mediasize - sectorsize;
temp = malloc(sectorsize);
if (temp == NULL) { if (temp == NULL) {
temp = malloc(sectorsize); syslog(LOG_ERR, "%m");
if (temp == NULL) { goto closefd;
syslog(LOG_ERR, "%m");
goto closefd;
}
} }
if (lseek(fd, lasthd, SEEK_SET) != lasthd || if (lseek(fd, lasthd, SEEK_SET) != lasthd ||
read(fd, temp, sectorsize) != (ssize_t)sectorsize) { read(fd, temp, sectorsize) != (ssize_t)sectorsize) {
@ -749,6 +748,7 @@ DoFile(const char *savedir, const char *device)
} }
xo_close_container_h(xostdout, "crashdump"); xo_close_container_h(xostdout, "crashdump");
xo_finish_h(xostdout); xo_finish_h(xostdout);
free(temp);
close(fd); close(fd);
return; return;
@ -756,6 +756,7 @@ DoFile(const char *savedir, const char *device)
fclose(fp); fclose(fp);
closefd: closefd:
free(temp);
close(fd); close(fd);
} }