[LTP] [PATCH v2] mmapstress04: rewrite to fix heap overwrite

Cyril Hrubis
2017-05-03T12:35:41Z

Hi!
> +static void setup(void)
> +{
> + page_size = getpagesize();
> +
> + /*
> + * Pick large enough area, PROT_NONE doesn't matter,
> + * because we remap it later.
> + */
> + mmap_area = SAFE_MMAP(NULL, page_size * NUM_PAGES, PROT_NONE,
> + MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
> +}
> +
> +static void write_fully(int fd, void *buf, int len)
> +{
> + do {
> + len -= SAFE_WRITE(0, fd, buf, len);
> + buf += len;

This appears to be wrong. If SAFE_WRITE() writes 1 byte we end up with
offset len - 1 and lenght len - 1 which will cause reads outside of the
buffer.

We have to do:

ret = SAFE_WRITE(...);
buf += ret;
len -= ret;

> + } while (len > 0);
> +}

Otherwise it's fine. Acked with the write function fixed.

--
Cyril Hrubis
chrubis@suse.cz