Page MenuHomeFreeBSD

savecore(8): Fix buffer overrun inspecting disks with varying sector size
ClosedPublic

Authored by cem on Oct 6 2016, 2:52 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Jun 25, 5:01 PM
Unknown Object (File)
Sat, Jun 22, 3:53 AM
Unknown Object (File)
Wed, Jun 19, 7:31 PM
Unknown Object (File)
May 1 2024, 4:08 PM
Unknown Object (File)
Apr 20 2024, 11:55 AM
Unknown Object (File)
Mar 22 2024, 10:12 PM
Unknown Object (File)
Mar 22 2024, 10:12 PM
Unknown Object (File)
Mar 22 2024, 10:12 PM
Subscribers
None

Details

Summary

A premature optimization lead to caching a native-sector sized memory
allocation. If the program examined a 512 byte sector disk, then a 4096
byte sector disk, the program would overrun the cached 512 byte buffer.

Just remove the optimization to fix the bug.

Noticed by: markj

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

cem retitled this revision from to savecore(8): Fix buffer overrun inspecting disks with varying sector size.
cem updated this object.
cem edited the test plan for this revision. (Show Details)
cem added reviewers: markj, rpokala, ambrisko, emaste.

'temp' is the buffer you read the header into, and also what you use to write the "cleared" header. So what's 'buf'?

'temp' is the buffer you read the header into, and also what you use to write the "cleared" header. So what's 'buf'?

temp is used for kernel dump metadata and is only a single sector large. buf is used for streaming dump data off the disk, and is 1MB.

markj edited edge metadata.

Thanks!

This revision is now accepted and ready to land.Oct 6 2016, 3:56 AM
rpokala edited edge metadata.
This revision was automatically updated to reflect the committed changes.