Re: [PATCH v2 perf-tools-next 3/6] perf trace: Validate payload bounds in augmented buffer beautifier

[sashiko-bot@kernel.org]

> When pretty-printing non-string augmented buffers via
> syscall_arg__scnprintf_buf(), augmented_arg->size is not validated
> against the remaining buffer size (arg->augmented.size).
> 
> If a malformed or truncated perf.data record provides an invalid or
> excessively large augmented_arg->size:
>     1.  If arg->augmented.size is smaller than sizeof(*augmented_arg),
>         dereferencing augmented_arg->size reads past the available
>         buffer.
> 
>     2.  The loop reads up to augmented_arg->size bytes from
>         augmented_arg->value without verifying that they exist within
>         the buffer, leading to buffer over-reads.
> 
>     3.  Calculating consumed = sizeof(*augmented_arg) +
>         augmented_arg->size can overflow signed integer bounds or cause
>         arg->augmented.size to underflow, advancing arg->augmented.args
>         out of bounds and corrupting the parsing state for subsequent
>         arguments in multi-argument syscalls.
> 
> Validate that arg->augmented.size is large enough to hold
> sizeof(*augmented_arg) and that augmented_arg->size is within the bounds
> of the remaining buffer before iterating or calculating consumed bytes.
> If validation fails, fall back to printing the raw pointer value.
> 
> Fixes: b257fac12f38 ("perf trace: Pretty print buffer data")
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907015140.363076-1-atomlin@atomlin.com?part=3