Re: [PATCH] modpost: fix buffer overflow

[Jiri Benc <jbenc@suse.cz>]

On Wed, 15 Mar 2006 15:57:28 +0100, Bernd Petrovitsch wrote:
> Silly me. To make it more obvious whatz I really meant was:
> ----  snip  ----
> 	if (buf->size - buf->pos < len + 1) {
> 		while (buf->size - buf->pos < len + 1)
> 			buf->size += 128;
> 		buf->p = realloc(buf->p, buf->size);
> 	}
> ----  snip  ----

Yes, this is probably better. New version of the patch follows.

---->8----

I got SIGABRT in modpost when compiling a module really deeply nested in
a filesystem (path > 100 chars):

>   Building modules, stage 2.
>   MODPOST
> *** glibc detected *** scripts/mod/modpost: realloc(): invalid next size: 0x0809f588 ***
> [...]

This patch fixes that problem.

Signed-off-by: Jiri Benc <jbenc@suse.cz>

--- linux-2.6.16-rc6.orig/scripts/mod/modpost.c
+++ linux-2.6.16-rc6/scripts/mod/modpost.c
@@ -553,7 +553,8 @@ void __attribute__((format(printf, 2, 3)
 	va_start(ap, fmt);
 	len = vsnprintf(tmp, SZ, fmt, ap);
 	if (buf->size - buf->pos < len + 1) {
-		buf->size += 128;
+		while (buf->size - buf->pos < len + 1)
+			buf->size += 128;
 		buf->p = realloc(buf->p, buf->size);
 	}
 	strncpy(buf->p + buf->pos, tmp, len + 1);


-- 
Jiri Benc
SUSE Labs