Re: [PATCH] modpost: fix buffer overflow

[Bernd Petrovitsch <bernd@firmix.at>]

On Wed, 2006-03-15 at 15:44 +0100, Jiri Benc wrote:
> I got SIGABRT in modpost when building a module really deeply nested in
> a filesystem (path > 100 chars):
> 
> >   Building modules, stage 2.
> >   MODPOST
> > *** glibc detected *** scripts/mod/modpost: realloc(): invalid next size: 0x0809f588 ***
> > [...]
> 
> This patch fixes that problem.
> 
> Signed-off-by: Jiri Benc <jbenc@suse.cz>
> 
> --- linux-2.6.16-rc6.orig/scripts/mod/modpost.c
> +++ linux-2.6.16-rc6/scripts/mod/modpost.c
> @@ -552,7 +552,7 @@ void __attribute__((format(printf, 2, 3)
>  	
>  	va_start(ap, fmt);
>  	len = vsnprintf(tmp, SZ, fmt, ap);
> -	if (buf->size - buf->pos < len + 1) {
> +	while (buf->size - buf->pos < len + 1) {
>  		buf->size += 128;
>  		buf->p = realloc(buf->p, buf->size);
>  	}

Are you sure you won't pull the line with realloc() out of the loop and
do it once afterwards?

	Bernd
-- 
Firmix Software GmbH                   http://www.firmix.at/
mobil: +43 664 4416156                 fax: +43 1 7890849-55
          Embedded Linux Development and Services