Messages in this thread | | | From | "Wang, Weilin" <> | Subject | RE: [RFC PATCH v4 1/6] perf stat: Parse and find tpebs events when parsing metrics to prepare for perf record sampling | Date | Wed, 13 Mar 2024 00:27:45 +0000 |
| |
> -----Original Message----- > From: Andi Kleen <ak@linux.intel.com> > Sent: Tuesday, March 12, 2024 4:58 PM > To: Wang, Weilin <weilin.wang@intel.com> > Cc: Namhyung Kim <namhyung@kernel.org>; Ian Rogers > <irogers@google.com>; Arnaldo Carvalho de Melo <acme@kernel.org>; Peter > Zijlstra <peterz@infradead.org>; Ingo Molnar <mingo@redhat.com>; > Alexander Shishkin <alexander.shishkin@linux.intel.com>; Jiri Olsa > <jolsa@kernel.org>; Hunter, Adrian <adrian.hunter@intel.com>; Kan Liang > <kan.liang@linux.intel.com>; linux-perf-users@vger.kernel.org; linux- > kernel@vger.kernel.org; Taylor, Perry <perry.taylor@intel.com>; Alt, Samantha > <samantha.alt@intel.com>; Biggers, Caleb <caleb.biggers@intel.com> > Subject: Re: [RFC PATCH v4 1/6] perf stat: Parse and find tpebs events when > parsing metrics to prepare for perf record sampling > > weilin.wang@intel.com writes: > > + > > + new_event->tpebs_name = strdup(id); > > + *p = '\0'; > > + name = malloc(strlen(id) + 2); > > + if (!name) > > + return -ENOMEM; > > + > > + at = strchr(id, '@'); > > + if (at != NULL) { > > + *at = '/'; > > + at = strchr(id, '@'); > > + *at = '/'; > > + strcpy(name, id); > > + strcat(name, "p"); > > + } else { > > + strcpy(name, id); > > + strcat(name, ":p"); > > > This seems like a buffer overflow because :p is 3 bytes including 0, > but you only allocate + 2. > You should really use safe string primitives, then you would have > noticed the truncation. >
I will double check and update this part.
Thanks, Weilin
> -Andi
| |