From patchwork Thu Mar 9 13:10:58 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Allain Legacy X-Patchwork-Id: 21635 X-Patchwork-Delegate: thomas@monjalon.net Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [IPv6:::1]) by dpdk.org (Postfix) with ESMTP id DA95DD04C; Thu, 9 Mar 2017 14:12:11 +0100 (CET) Received: from mail.windriver.com (mail.windriver.com [147.11.1.11]) by dpdk.org (Postfix) with ESMTP id 9279137B4 for ; Thu, 9 Mar 2017 14:11:33 +0100 (CET) Received: from ALA-HCA.corp.ad.wrs.com (ala-hca.corp.ad.wrs.com [147.11.189.40]) by mail.windriver.com (8.15.2/8.15.1) with ESMTPS id v29DBWXQ014717 (version=TLSv1 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 9 Mar 2017 05:11:32 -0800 (PST) Received: from yow-cgts4-lx.wrs.com (128.224.145.137) by ALA-HCA.corp.ad.wrs.com (147.11.189.50) with Microsoft SMTP Server (TLS) id 14.3.294.0; Thu, 9 Mar 2017 05:11:31 -0800 From: Allain Legacy To: , CC: , Date: Thu, 9 Mar 2017 08:10:58 -0500 Message-ID: <1489065060-98370-5-git-send-email-allain.legacy@windriver.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1489065060-98370-1-git-send-email-allain.legacy@windriver.com> References: <1488482971-170522-1-git-send-email-allain.legacy@windriver.com> <1489065060-98370-1-git-send-email-allain.legacy@windriver.com> MIME-Version: 1.0 X-Originating-IP: [128.224.145.137] Subject: [dpdk-dev] [PATCH v2 4/6] cfgfile: use strnlen to constrain memchr search X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" The call to memchr() uses the absolute length of the string buffer instead of the actual length of the string returned by fgets(). This causes the search to go beyond the '\n' character and find ';' characters in random garbage on the stack. This then causes the 'len' variable to be updated and the subsequent search for the '=' character to potentially find one beyond the first newline character. Since this bug relies on ';' and '=' characters appearing in random places in the 'buffer' variable it is intermittently reproducible at best. Signed-off-by: Allain Legacy --- lib/librte_cfgfile/rte_cfgfile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/librte_cfgfile/rte_cfgfile.c b/lib/librte_cfgfile/rte_cfgfile.c index 7ecab22..416b3b6 100644 --- a/lib/librte_cfgfile/rte_cfgfile.c +++ b/lib/librte_cfgfile/rte_cfgfile.c @@ -152,7 +152,7 @@ struct rte_cfgfile * "Check if line too long\n", lineno); goto error1; } - pos = memchr(buffer, params->comment_character, sizeof(buffer)); + pos = memchr(buffer, params->comment_character, len); if (pos != NULL) { *pos = '\0'; len = pos - buffer;