bugGNU FreeIPMI - Bugs: bug #38866, buffer overrun in _output_date()...

 
 

bug #38866: buffer overrun in _output_date() from sel/ipmi-sel-string.c:675

Submitted by:  Rob Swindell <rswindell>
Submitted on:  Thu 02 May 2013 02:02:39 AM UTC  
 
Category: ipmi-selSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Crash
Status: NonePrivacy: Public
Assigned to: NoneOpen/Closed: Closed
Operating System: GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 02 May 2013 03:06:09 PM UTC, comment #1:

Thanks for the catch. Is this occurring regularly for you w/ 1.2.6? Or has it always been around? Just wondering if I need to do an emergency 1.2.7 release.

Albert Chu <chu11>
Project Administrator
Thu 02 May 2013 02:02:39 AM UTC, original submission:

call-stack trace:

#0 0x00007f16d3e18425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007f16d3e1bb8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007f16d3e5639e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007f16d3eec807 in __fortify_fail () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x00007f16d3eeb700 in __chk_fail () from /lib/x86_64-linux-gnu/libc.so.6
#5 0x00007f16d43a52c2 in memset (__len=257, __ch=0, __dest=0x7fff37f97ce0) at /usr/include/x86_64-linux-gnu/bits/string3.h:85
#6 _output_date (wlen=0x7fff37f97cd0, flags=22, buflen=4096, buf=0x7fff37f97eb0 "", sel_record_type=<optimized out>, sel_entry=0x7fff37f97df0, ctx=0x139b1d0) at sel/ipmi-sel-string.c:675
#7 sel_format_record_string (ctx=0x139b1d0, fmt=0x42797e "d", sel_record=<optimized out>, sel_record_len=<optimized out>, buf=0x7fff37f97eb0 "", buflen=4096, flags=22) at sel/ipmi-sel-string.c:3443
#8 0x00007f16d439d5cf in ipmi_sel_parse_read_record_string (ctx=0x139b1d0, fmt=0x42797d "%d", sel_record=<optimized out>, sel_record_len=<optimized out>, buf=<optimized out>, buflen=<optimized out>,
flags=22) at sel/ipmi-sel.c:2059
#9 0x00000000004057be in _normal_output_date (state_data=0x7fff37f9c0c0, flags=<optimized out>) at ipmi-sel.c:771
#10 0x0000000000406824 in _normal_output (state_data=0x7fff37f9c0c0, record_type=<optimized out>) at ipmi-sel.c:1260
#11 0x00000000004072b5 in _sel_parse_callback (ctx=<optimized out>, callback_data=0x7fff37f9c0c0) at ipmi-sel.c:1622
#12 0x00007f16d439ec35 in ipmi_sel_parse (ctx=0x139b1d0, record_id_start=0, record_id_last=65535, callback=0x406f80 <_sel_parse_callback>, callback_data=0x7fff37f9c0c0) at sel/ipmi-sel.c:1099
#13 0x0000000000405379 in _display_sel_records (state_data=0x7fff37f9c0c0) at ipmi-sel.c:2100

You can't memset (tmpbuf, '\0', SEL_BUFFER_LENGTH + 1) when tmpbuf is only SEL_BUFFER_LENGTH bytes in length.

-Rob

Rob Swindell <rswindell>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by chu11 (Posted a comment)
  • -unavailable- added by rswindell (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 02 May 2013 09:49:25 PM UTCchu11Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1