Messages in this thread | ![/](/images/icornerl.gif) | | From | Andi Kleen <> | Subject | Re: [RFC PATCH v4 1/6] perf stat: Parse and find tpebs events when parsing metrics to prepare for perf record sampling | Date | Tue, 12 Mar 2024 16:58:22 -0700 |
| |
weilin.wang@intel.com writes: > + > + new_event->tpebs_name = strdup(id); > + *p = '\0'; > + name = malloc(strlen(id) + 2); > + if (!name) > + return -ENOMEM; > + > + at = strchr(id, '@'); > + if (at != NULL) { > + *at = '/'; > + at = strchr(id, '@'); > + *at = '/'; > + strcpy(name, id); > + strcat(name, "p"); > + } else { > + strcpy(name, id); > + strcat(name, ":p");
This seems like a buffer overflow because :p is 3 bytes including 0, but you only allocate + 2. You should really use safe string primitives, then you would have noticed the truncation.
-Andi
| ![\](/images/icornerr.gif) |