From owner-dev-commits-src-all@freebsd.org Thu Jun 17 17:53:42 2021 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4DCFE656C6F; Thu, 17 Jun 2021 17:53:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4G5V6G1Vp7z3NYl; Thu, 17 Jun 2021 17:53:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 1C56D13BFA; Thu, 17 Jun 2021 17:53:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 15HHrg6A049650; Thu, 17 Jun 2021 17:53:42 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 15HHrg9g049649; Thu, 17 Jun 2021 17:53:42 GMT (envelope-from git) Date: Thu, 17 Jun 2021 17:53:42 GMT Message-Id: <202106171753.15HHrg9g049649@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: a877965fa3da - main - dtrace: fix an out of bound read and a NULL pointer increment MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a877965fa3da218bceaaa0f51c4d7770e64e6df0 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Jun 2021 17:53:42 -0000 The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=a877965fa3da218bceaaa0f51c4d7770e64e6df0 commit a877965fa3da218bceaaa0f51c4d7770e64e6df0 Author: Domagoj Stolfa AuthorDate: 2021-06-17 17:35:33 +0000 Commit: Mark Johnston CommitDate: 2021-06-17 17:52:32 +0000 dtrace: fix an out of bound read and a NULL pointer increment In dt_cc.c when the provider is an empty string, accessing strlen(pdp->dtpd_provider) - 1 will result in a pdp->dtpd_provider[-1] access. Similarly, in dt_ident.c, if p2 is a NULL pointer, doing a p2++ on it is undefined behaviour. Reviewed by: markj MFC after: 1 week Sponsored by: Google Differential Revision: https://reviews.freebsd.org/D30778 --- cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c | 6 +++++- cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c | 4 +++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c index 8ec5dd61b8ee..e63771c91e08 100644 --- a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c +++ b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c @@ -1691,6 +1691,7 @@ dt_setcontext(dtrace_hdl_t *dtp, dtrace_probedesc_t *pdp) dt_ident_t *idp; char attrstr[8]; int err; + size_t prov_len; /* * Both kernel and pid based providers are allowed to have names @@ -1704,7 +1705,10 @@ dt_setcontext(dtrace_hdl_t *dtp, dtrace_probedesc_t *pdp) * On an error, dt_pid_create_probes() will set the error message * and tag -- we just have to longjmp() out of here. */ - if (isdigit(pdp->dtpd_provider[strlen(pdp->dtpd_provider) - 1]) && + + prov_len = strlen(pdp->dtpd_provider); + + if ((prov_len > 0 && isdigit(pdp->dtpd_provider[prov_len - 1])) && ((pvp = dt_provider_lookup(dtp, pdp->dtpd_provider)) == NULL || pvp->pv_desc.dtvd_priv.dtpp_flags & DTRACE_PRIV_PROC) && dt_pid_create_probes(pdp, dtp, yypcb) != 0) { diff --git a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c index b9164ac26cf9..5ff772be041d 100644 --- a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c +++ b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c @@ -210,8 +210,10 @@ dt_idcook_func(dt_node_t *dnp, dt_ident_t *idp, int argc, dt_node_t *args) } } - for (p2 = strchr(p2, ','); p2++ != NULL; i++) + for (p2 = strchr(p2, ','); p2 != NULL; i++) { + p2++; p2 = strchr(p2, ','); + } /* * We first allocate a new ident signature structure with the