Messages in this thread | | | Date | Wed, 29 Mar 2023 07:52:29 +0300 | Subject | Re: [PATCH v1] perf symbol: Avoid use after free | From | Adrian Hunter <> |
| |
On 29/03/23 02:44, Ian Rogers wrote: > If demangling succeeds then sym_name is set to the demangled string > that is freed. Rather than test if sym_name is empty and possibly > use-after-free on the return path, expand out the alternatives.
Looks the same as:
https://lore.kernel.org/linux-perf-users/20230316194156.8320-2-adrian.hunter@intel.com/
> > Signed-off-by: Ian Rogers <irogers@google.com> > --- > tools/perf/util/symbol-elf.c | 18 ++++++++++-------- > 1 file changed, 10 insertions(+), 8 deletions(-) > > diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c > index c0a2de42c51b..b7e3e492bff3 100644 > --- a/tools/perf/util/symbol-elf.c > +++ b/tools/perf/util/symbol-elf.c > @@ -577,15 +577,17 @@ static bool get_plt_got_name(GElf_Shdr *shdr, size_t i, > /* Get the associated symbol */ > gelf_getsym(di->dynsym_data, vr->sym_idx, &sym); > sym_name = elf_sym__name(&sym, di->dynstr_data); > - demangled = demangle_sym(di->dso, 0, sym_name); > - if (demangled != NULL) > - sym_name = demangled; > - > - snprintf(buf, buf_sz, "%s@plt", sym_name); > - > - free(demangled); > + if (*sym_name == '\0') > + return false; > > - return *sym_name; > + demangled = demangle_sym(di->dso, 0, sym_name); > + if (demangled != NULL) { > + snprintf(buf, buf_sz, "%s@plt", demangled); > + free(demangled); > + } else { > + snprintf(buf, buf_sz, "%s@plt", sym_name); > + } > + return true; > } > > static int dso__synthesize_plt_got_symbols(struct dso *dso, Elf *elf,
| |