[PATCH v1 2/7] perf evsel: Add bounds check for PERF_RECORD_CALLCHAIN_DEFERRED ips array

[Ian Rogers <irogers@google.com>]

In __evsel__parse_sample(), verify that event->callchain_deferred.nr and
the trailing ips[] array fit within event->header.size using
OVERFLOW_CHECK_u64() and OVERFLOW_CHECK() before exposing data->callchain
to callers.

Fixes: da27c4379ce6 ("perf session: Add minimum event size and alignment validation")
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/util/evsel.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index d060fca8090f..64f090ebaa5a 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -3474,9 +3474,12 @@ int __evsel__parse_sample(struct evsel *evsel, union perf_event *event,
 	if (event->header.type == PERF_RECORD_CALLCHAIN_DEFERRED) {
 		const u64 max_callchain_nr = UINT64_MAX / sizeof(u64);
 
+		OVERFLOW_CHECK_u64(&event->callchain_deferred.nr);
 		data->callchain = (struct ip_callchain *)&event->callchain_deferred.nr;
 		if (data->callchain->nr > max_callchain_nr)
 			goto out_efault;
+		OVERFLOW_CHECK(event->callchain_deferred.ips,
+			       data->callchain->nr * sizeof(u64), max_size);
 
 		data->deferred_cookie = event->callchain_deferred.cookie;
 
-- 
2.56.0.307.g5fe7bd680c-goog