Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 6 Oct 2016 05:16:44 +0000 (UTC)
From:      "Conrad E. Meyer" <cem@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r306752 - head/sbin/savecore
Message-ID:  <201610060516.u965GiwY099817@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: cem
Date: Thu Oct  6 05:16:44 2016
New Revision: 306752
URL: https://svnweb.freebsd.org/changeset/base/306752

Log:
  savecore(8): Fix buffer overrun inspecting disks with varying sector size
  
  A premature optimization lead to caching a native-sector sized memory
  allocation.  If the program examined a 512 byte sector disk, then a 4096
  byte sector disk, the program would overrun the cached 512 byte buffer.
  
  Just remove the optimization to fix the bug.  This was introduced with the 4Kn
  dump support in r298076.
  
  Reported by:	markj
  Reviewed by:	markj, rpokala
  Sponsored by:	Dell EMC Isilon
  Differential Revision:	https://reviews.freebsd.org/D8162

Modified:
  head/sbin/savecore/savecore.c

Modified: head/sbin/savecore/savecore.c
==============================================================================
--- head/sbin/savecore/savecore.c	Thu Oct  6 03:32:30 2016	(r306751)
+++ head/sbin/savecore/savecore.c	Thu Oct  6 05:16:44 2016	(r306752)
@@ -436,7 +436,8 @@ DoFile(const char *savedir, const char *
 {
 	xo_handle_t *xostdout, *xoinfo;
 	static char infoname[PATH_MAX], corename[PATH_MAX], linkname[PATH_MAX];
-	static char *buf = NULL, *temp = NULL;
+	static char *buf = NULL;
+	char *temp = NULL;
 	struct kerneldumpheader kdhf, kdhl;
 	off_t mediasize, dumpsize, firsthd, lasthd;
 	FILE *info, *fp;
@@ -498,12 +499,10 @@ DoFile(const char *savedir, const char *
 	}
 
 	lasthd = mediasize - sectorsize;
+	temp = malloc(sectorsize);
 	if (temp == NULL) {
-		temp = malloc(sectorsize);
-		if (temp == NULL) {
-			syslog(LOG_ERR, "%m");
-			goto closefd;
-		}
+		syslog(LOG_ERR, "%m");
+		goto closefd;
 	}
 	if (lseek(fd, lasthd, SEEK_SET) != lasthd ||
 	    read(fd, temp, sectorsize) != (ssize_t)sectorsize) {
@@ -749,6 +748,7 @@ nuke:
 	}
 	xo_close_container_h(xostdout, "crashdump");
 	xo_finish_h(xostdout);
+	free(temp);
 	close(fd);
 	return;
 
@@ -756,6 +756,7 @@ closeall:
 	fclose(fp);
 
 closefd:
+	free(temp);
 	close(fd);
 }

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201610060516.u965GiwY099817>