[LTP] [PATCH v2] mmapstress04: rewrite to fix heap overwrite

Jan Stancek
2017-05-03T12:49:46Z

----- Original Message -----
> Hi!
> > +static void setup(void)
> > +{
> > + page_size = getpagesize();
> > +
> > + /*
> > + * Pick large enough area, PROT_NONE doesn't matter,
> > + * because we remap it later.
> > + */
> > + mmap_area = SAFE_MMAP(NULL, page_size * NUM_PAGES, PROT_NONE,
> > + MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
> > +}
> > +
> > +static void write_fully(int fd, void *buf, int len)
> > +{
> > + do {
> > + len -= SAFE_WRITE(0, fd, buf, len);
> > + buf += len;
>
> This appears to be wrong. If SAFE_WRITE() writes 1 byte we end up with
> offset len - 1 and lenght len - 1 which will cause reads outside of the
> buffer.

You're right, it's wrong :-(.

>
> We have to do:
>
> ret = SAFE_WRITE(...);
> buf += ret;
> len -= ret;
>
> > + } while (len > 0);
> > +}
>
> Otherwise it's fine. Acked with the write function fixed.

Fixed and pushed.

Regards,
Jan