[PATCH] vmcore-dmesg stack smashing happend in extreme case

[arthur <zzou@redhat.com>]

Description
in dump_dmesg_structured() the out_buf size is 4096, and if the
length is less than 4080( 4096-16 ) it won't really write out.
Normally, after writing one or four chars to the out_buf, it will
check the length of out_buf. But in extreme cases, 19 chars was
written to the out_buf before checking the length. This may cause
the stack corruption. If the length was 4079 (won't realy write out),
and then write 19 chars to it. the out_buf will overflow.

Solution
Change 16 to 32 and always check the lenth of out_buf before move to
next record, thus can make sure that at the beginning of a message
we always have 32 bytes of buffer.

Signed-off-by: arthur <zzou@redhat.com>
---
 vmcore-dmesg/vmcore-dmesg.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/vmcore-dmesg/vmcore-dmesg.c b/vmcore-dmesg/vmcore-dmesg.c
index 0345660..0d323c1 100644
--- a/vmcore-dmesg/vmcore-dmesg.c
+++ b/vmcore-dmesg/vmcore-dmesg.c
@@ -674,7 +674,7 @@ static void dump_dmesg_structured(int fd)
 			else
 				out_buf[len++] = c;
 
-			if (len >= OUT_BUF_SIZE - 16) {
+			if (len >= OUT_BUF_SIZE - 32) {
 				write_to_stdout(out_buf, len);
 				len = 0;
 			}
@@ -682,6 +682,11 @@ static void dump_dmesg_structured(int fd)
 
 		out_buf[len++] = '\n';
 
+		if (len >= OUT_BUF_SIZE - 32) {
+			write_to_stdout(out_buf, len);
+			len = 0;
+		}
+
 		/* Move to next record */
 		current_idx = log_next(buf, current_idx);
 	}
-- 
1.8.4.2


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec