mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 17:47:41 +02:00
b6bb3b005d
dump_insn() tracks remaining buffer space with a 'left' variable,
but the loop subtracts the cumulative offset 'n' each iteration
instead of just the per-iteration delta:
n += snprintf(x->out + n, left, "%02x ", inbuf[i]);
left -= n; /* BUG: n is cumulative, not the delta */
After two iterations left goes massively negative, wrapping to a
huge value when passed as size_t to snprintf(), disabling all bounds
checking for the rest of the loop.
Switch to scnprintf() accumulation using sizeof(x->out) - n as the
remaining space, which is always correct and eliminates the separate
'left' variable entirely.
Fixes:
|
||
|---|---|---|
| .. | ||
| Build | ||
| intel-pt-decoder.c | ||
| intel-pt-decoder.h | ||
| intel-pt-insn-decoder.c | ||
| intel-pt-insn-decoder.h | ||
| intel-pt-log.c | ||
| intel-pt-log.h | ||
| intel-pt-pkt-decoder.c | ||
| intel-pt-pkt-decoder.h | ||