github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf util: Fix perf_exe() buffer write past end

Browse Source 
perf_exe() passes len to readlink() and then unconditionally writes a
trailing NUL at buf[n]. If readlink() returns len, the write lands one
byte past the buffer.

Read at most len - 1 bytes and keep the existing NUL termination. Also
guard the fallback path for tiny buffers so copying "perf" cannot
overflow.

Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Miguel Martín Gil <miguel.martin.gil.uni@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Miguel Martín Gil 2026-05-26 13:08:52 +02:00 committed by Arnaldo Carvalho de Melo
parent 3dfaf02e55
commit 167bef4df6
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
tools/perf/util/util.c
View File

@ -419,11 +419,21 @@ int perf_tip(char **strp, const char *dirpath)
char *perf_exe(char *buf, int len)
{
int n = readlink("/proc/self/exe", buf, len);
int n;
if (len <= 0)
return buf;
n = readlink("/proc/self/exe", buf, len - 1);
if (n > 0) {
buf[n] = 0;
return buf;
}
if (len < (int)sizeof("perf")) {
buf[0] = '\0';
return buf;
}
return strcpy(buf, "perf");
}