* [LTP] [PATCH] syscalls/fork14: Fix Buffer overflow
@ 2020-06-09 7:16 Vikas Kumar
2020-06-11 11:33 ` Jan Stancek
0 siblings, 1 reply; 2+ messages in thread
From: Vikas Kumar @ 2020-06-09 7:16 UTC (permalink / raw)
To: ltp
This change basically avoids the buffer overflow by keeping the check count
to allocation limit
The problem occurs when there is no failure and i == EXTENT, so
pointer_vec[EXTENT] goes beyond the allocated buffer.
Signed-off-by: Vikas Kumar <vikas.kumar2@arm.com>
Reported-by: Amit Kachhap <amit.kachhap@arm.com>
---
testcases/kernel/syscalls/fork/fork14.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/testcases/kernel/syscalls/fork/fork14.c b/testcases/kernel/syscalls/fork/fork14.c
index a92aa46ad..2a20d9df8 100644
--- a/testcases/kernel/syscalls/fork/fork14.c
+++ b/testcases/kernel/syscalls/fork/fork14.c
@@ -132,6 +132,9 @@ static int fork_test(void)
}
}
+ if (i == EXTENT)
+ i--;
+
clear_memory_map:
for (j = 0; j <= i; j++) {
if (pointer_vec[j])
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [LTP] [PATCH] syscalls/fork14: Fix Buffer overflow
2020-06-09 7:16 [LTP] [PATCH] syscalls/fork14: Fix Buffer overflow Vikas Kumar
@ 2020-06-11 11:33 ` Jan Stancek
0 siblings, 0 replies; 2+ messages in thread
From: Jan Stancek @ 2020-06-11 11:33 UTC (permalink / raw)
To: ltp
----- Original Message -----
> This change basically avoids the buffer overflow by keeping the check count
> to allocation limit
> The problem occurs when there is no failure and i == EXTENT, so
> pointer_vec[EXTENT] goes beyond the allocated buffer.
I changed the patch to use a new variable, that reflects number of used
fields, and pushed.
Thanks,
Jan
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-06-11 11:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-06-09 7:16 [LTP] [PATCH] syscalls/fork14: Fix Buffer overflow Vikas Kumar
2020-06-11 11:33 ` Jan Stancek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox