Bug 717860 - Static array overrun
Static array overrun
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: oprofile (Show other bugs)
6.1
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: William Cohen
qe-baseos-tools
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-06-30 04:25 EDT by Michal Luscon
Modified: 2011-12-06 12:56 EST (History)
1 user (show)

See Also:
Fixed In Version: oprofile-0.9.6-18.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-12-06 12:56:51 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Michal Luscon 2011-06-30 04:25:37 EDT
Description of problem:

/daemon/opd_ibs.c:636, 652 - Function strncat may cause overrunning of string variable filename if length of session_dir is greater than 1005.

Version-Release number of selected component (if applicable):
0.9.6-12

Additional info:

These defects were probably introduced by Red Hat patches.
Comment 2 William Cohen 2011-07-08 17:04:09 EDT
This code is directly from the upstream oprofile, so the problem also exists in newer upstream versions of oprofile:

http://oprofile.git.sourceforge.net/git/gitweb.cgi?p=oprofile/oprofile;a=blob;f=daemon/opd_ibs.c;
Comment 3 William Cohen 2011-07-26 11:37:27 EDT
Patch has been reviewed and will be in upstream oprofile. Built RHEL-6 oprofile with patch.
Comment 6 Petr Muller 2011-09-30 11:25:42 EDT
cppcheck shows this is fixed:

:: [17:24:25] ::    --- /tmp/tmp.IhRdJzrB62/output1.log	2011-09-30 17:24:05.228962036 +0200
:: [17:24:25] ::    +++ /tmp/tmp.IhRdJzrB62/output2.log	2011-09-30 17:24:24.258111476 +0200
:: [17:24:25] ::    @@ -3,2 +2,0 @@
:: [17:24:25] ::    -daemon/opd_ibs.c@line 636: Dangerous usage of 'filename' (strncpy doesn't always 0-terminate it) [error]
:: [17:24:25] ::    -daemon/opd_ibs.c@line 652: Dangerous usage of 'filename' (strncpy doesn't always 0-terminate it) [error]


Moving to VERIFIED
Comment 7 errata-xmlrpc 2011-12-06 12:56:51 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1712.html

Note You need to log in before you can comment on or make changes to this bug.