mirror of
https://github.com/torvalds/linux.git
synced 2026-11-10 17:11:02 +01:00
116f95a0e2
perf_gtk__show_hierarchy() builds a merged column header for the hierarchy view with unbounded strcat() calls into a 512-byte stack buffer. The pieces being appended come from tracepoint field names and sort-key headers in perf.data, so a file with enough dynamic sort keys or long enough field names overflows the buffer. perf_gtk__add_hierarchy_entries() has a related bug in the loop that formats each entry's value columns. fmt->entry()/fmt->color() return via scnprintf(), so ret is clamped to at most hpp->size - 1, but advance_hpp(hpp, ret + 2) doesn't clamp: when ret hits that maximum, ret + 2 exceeds hpp->size by one, and hpp->size (size_t) underflows to roughly SIZE_MAX. The next iteration's fmt->entry() then writes into the caller's stack buffer using that bogus size, a second overflow. That same loop also saves bf/size at the top of each iteration but only restored hpp->buf/hpp->size to them before recursing into non-leaf children. Leaf entries left the buffer state advanced from the format loop, so the next sibling in the traversal inherited a shrunk hpp->size and an already-advanced hpp->buf, eventually running hpp->size down to 0 and pointing bf past the end of the stack buffer for the strim(bf) call. Fix the header builder by tracking the write offset and using scnprintf() for each append, same pattern already used elsewhere in this file. Fix the entry loop by clamping the amount passed to advance_hpp() to what's actually left in the buffer, and by restoring hpp->buf/hpp->size unconditionally after formatting each entry instead of only before recursing. Both bugs predate the perf GTK UI's move to GTK 4; neither function is touched by that port. Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> |
||
|---|---|---|
| .. | ||
| accounting | ||
| arch | ||
| bootconfig | ||
| bpf | ||
| build | ||
| certs | ||
| cgroup | ||
| counter | ||
| crypto | ||
| debugging | ||
| dma | ||
| docs | ||
| firewire | ||
| firmware | ||
| gpio | ||
| hv | ||
| iio | ||
| include | ||
| kvm/kvm_stat | ||
| laptop | ||
| leds | ||
| lib | ||
| memory-model | ||
| mm | ||
| net | ||
| objtool | ||
| pcmcia | ||
| perf | ||
| platform/x86/amd | ||
| power | ||
| rcu | ||
| sched | ||
| sched_ext | ||
| scripts | ||
| sound | ||
| spi | ||
| testing | ||
| thermal | ||
| time | ||
| tracing | ||
| unittests | ||
| usb | ||
| verification | ||
| virtio | ||
| wmi | ||
| workqueue | ||
| writeback | ||
| Makefile | ||