[PATCH v2] vmcore-dmesg stack smashing happend in extreme case

[Simon Horman]

On Tue, Mar 11, 2014 at 09:42:15PM -0400, Vivek Goyal wrote:
> On Wed, Mar 12, 2014 at 09:27:02AM +0800, arthur wrote:
> > Description
> > in dump_dmesg_structured() the out_buf size is 4096, and if the
> > length is less than 4080( 4096-16 ) it won't really write out.
> > Normally, after writing one or four chars to the out_buf, it will
> > check the length of out_buf. But in extreme cases, 19 chars was
> > written to the out_buf before checking the length. This may cause
> > the stack corruption. If the length was 4079 (won't realy write out),
> > and then write 19 chars to it. the out_buf will overflow.
> > 
> > Solution
> > Change 16 to 64 thus can make sure that always have 64bytes before
> > moving to next records. why using 64 is that a long long int can take
> > 20 bytes. so the length of timestamp can be 44 ('[','.',']',' ') in
> > extreme case.
> > 
> > Signed-off-by: arthur <zzou at redhat.com>

Please include your given and family name in the From address and
Signed-off-by line unless you only have one name.

> > ---
> 
> Looks good to me.
> 
> Acked-by: Vivek Goyal <vgoyal at redhat.com>
> 
> Thanks
> Vivek
> 
> >  vmcore-dmesg/vmcore-dmesg.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/vmcore-dmesg/vmcore-dmesg.c b/vmcore-dmesg/vmcore-dmesg.c
> > index 0345660..e15cd91 100644
> > --- a/vmcore-dmesg/vmcore-dmesg.c
> > +++ b/vmcore-dmesg/vmcore-dmesg.c
> > @@ -674,7 +674,7 @@ static void dump_dmesg_structured(int fd)
> >  			else
> >  				out_buf[len++] = c;
> >  
> > -			if (len >= OUT_BUF_SIZE - 16) {
> > +			if (len >= OUT_BUF_SIZE - 64) {
> >  				write_to_stdout(out_buf, len);
> >  				len = 0;
> >  			}
> > -- 
> > 1.8.4.2
> > 
> > 
> > _______________________________________________
> > kexec mailing list
> > kexec at lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/kexec
> 
> _______________________________________________
> kexec mailing list
> kexec at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/kexec
>