Page MenuHomeFreeBSD

savecore(8): Fix buffer overrun inspecting disks with varying sector size
ClosedPublic

Authored by cem on Oct 6 2016, 2:52 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Dec 10, 12:01 AM
Unknown Object (File)
Thu, Nov 21, 10:13 PM
Unknown Object (File)
Nov 11 2024, 1:27 AM
Unknown Object (File)
Oct 22 2024, 12:53 PM
Unknown Object (File)
Oct 9 2024, 12:51 AM
Unknown Object (File)
Sep 22 2024, 7:31 AM
Unknown Object (File)
Sep 11 2024, 1:36 AM
Unknown Object (File)
Aug 31 2024, 12:13 PM
Subscribers
None

Details

Summary

A premature optimization lead to caching a native-sector sized memory
allocation. If the program examined a 512 byte sector disk, then a 4096
byte sector disk, the program would overrun the cached 512 byte buffer.

Just remove the optimization to fix the bug.

Noticed by: markj

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 5473
Build 5690: arc lint + arc unit

Event Timeline

cem retitled this revision from to savecore(8): Fix buffer overrun inspecting disks with varying sector size.
cem updated this object.
cem edited the test plan for this revision. (Show Details)
cem added reviewers: markj, rpokala, ambrisko, emaste.

'temp' is the buffer you read the header into, and also what you use to write the "cleared" header. So what's 'buf'?

'temp' is the buffer you read the header into, and also what you use to write the "cleared" header. So what's 'buf'?

temp is used for kernel dump metadata and is only a single sector large. buf is used for streaming dump data off the disk, and is 1MB.

markj edited edge metadata.

Thanks!

This revision is now accepted and ready to land.Oct 6 2016, 3:56 AM
rpokala edited edge metadata.
This revision was automatically updated to reflect the committed changes.