Bug 842012 - irqbalance segfault from off-by-one malloc
irqbalance segfault from off-by-one malloc
Status: CLOSED DUPLICATE of bug 843379
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: irqbalance (Show other bugs)
6.3
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Petr Holasek
Red Hat Kernel QE team
: Regression
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-20 17:16 EDT by Alex Williamson
Modified: 2016-10-04 00:08 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-02 17:30:27 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Alex Williamson 2012-07-20 17:16:35 EDT
Description of problem:
classify.c:int find_class(struct interrupt *irq, char *moduletext)
{
        ...
        /* Or biosdevname? */
        netdev = malloc(strlen(moduletext));
                        ^^^^^^^^^^^^^^^^^^

strlen does not include terminator

        if (netdev) {
                strcpy(netdev, moduletext);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^

strcpy does include terminator, oops

                 c = netdev;
                 while (*c && (isalnum(*c) || *c == '_')) {
                        c++;
                 }
                 /* Cut possible name suffix */
                 *c = '\0';
                 is_netdev = dev_to_bus(netdev, busname);
                 if (!is_netdev)
                        guess = IRQ_ETH;
                 free(netdev);
                 ^^^^^^^^^^^^^

libc gets very upset about corrupt memory here
        }

Fix is a simple +1 on the malloc

Version-Release number of selected component (if applicable):
irqbalance-0.55-34.el6.x86_64

How reproducible:
100%


Steps to Reproduce:
1. run kvm device assignment, irqbalance in the host bombs
2.
3.
  
Actual results:
segfault

Expected results:
works

Additional info:
Comment 7 Petr Holasek 2012-08-02 17:30:27 EDT
Closing as duplicate of #843379.

John, I'll paste your last comment there.

*** This bug has been marked as a duplicate of bug 843379 ***

Note You need to log in before you can comment on or make changes to this bug.