[PATCH v3] vmcore-dmesg stack smashing happend in extreme case

[Simon Horman]

On Wed, Mar 12, 2014 at 01:05:18PM +0800, Arthur Zou wrote:
> Description
> in dump_dmesg_structured() the out_buf size is 4096, and if the
> length is less than 4080( 4096-16 ) it won't really write out.
> Normally, after writing one or four chars to the out_buf, it will
> check the length of out_buf. But in extreme cases, 19 chars was
> written to the out_buf before checking the length. This may cause
> the stack corruption. If the length was 4079 (won't realy write out),
> and then write 19 chars to it. the out_buf will overflow.
> 
> Solution
> Change 16 to 64 thus can make sure that always have 64bytes before
> moving to next records. why using 64 is that a long long int can take
> 20 bytes. so the length of timestamp can be 44 ('[','.',']',' ') in
> extreme case.
> 
> Signed-off-by: Arthur Zou <zzou at redhat.com>
> Acked-by: Vivek Goyal <vgoyal at redhat.com>

Thanks, applied.

> ---
>  vmcore-dmesg/vmcore-dmesg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/vmcore-dmesg/vmcore-dmesg.c b/vmcore-dmesg/vmcore-dmesg.c
> index 0345660..e15cd91 100644
> --- a/vmcore-dmesg/vmcore-dmesg.c
> +++ b/vmcore-dmesg/vmcore-dmesg.c
> @@ -674,7 +674,7 @@ static void dump_dmesg_structured(int fd)
>  			else
>  				out_buf[len++] = c;
>  
> -			if (len >= OUT_BUF_SIZE - 16) {
> +			if (len >= OUT_BUF_SIZE - 64) {
>  				write_to_stdout(out_buf, len);
>  				len = 0;
>  			}
> -- 
> 1.8.4.2
>