From d99148ef7338d24780a2ca8eed4ee228bcb1d4af Mon Sep 17 00:00:00 2001 From: Jan Kratochvil Date: Sun, 2 Sep 2007 14:04:31 +0000 Subject: [PATCH] * linux-nat.c (linux_nat_make_corefile_notes): Fixed a buffer overflow. --- gdb/ChangeLog | 4 ++++ gdb/linux-nat.c | 17 ++++++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/gdb/ChangeLog b/gdb/ChangeLog index c2fbbba1af..d1777a0c54 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,3 +1,7 @@ +2007-09-02 Jan Kratochvil + + * linux-nat.c (linux_nat_make_corefile_notes): Fixed a buffer overflow. + 2007-09-01 Jan Kratochvil * Makefile.in (symfile.o): Update dependencies. diff --git a/gdb/linux-nat.c b/gdb/linux-nat.c index 128e83fdc9..90b8a3b845 100644 --- a/gdb/linux-nat.c +++ b/gdb/linux-nat.c @@ -2686,7 +2686,9 @@ linux_nat_make_corefile_notes (bfd *obfd, int *note_size) { struct linux_nat_corefile_thread_data thread_args; struct cleanup *old_chain; + /* The variable size must be >= sizeof (prpsinfo_t.pr_fname). */ char fname[16] = { '\0' }; + /* The variable size must be >= sizeof (prpsinfo_t.pr_psargs). */ char psargs[80] = { '\0' }; char *note_data = NULL; ptid_t current_ptid = inferior_ptid; @@ -2699,9 +2701,18 @@ linux_nat_make_corefile_notes (bfd *obfd, int *note_size) strncpy (psargs, get_exec_file (0), sizeof (psargs)); if (get_inferior_args ()) { - strncat (psargs, " ", sizeof (psargs) - strlen (psargs)); - strncat (psargs, get_inferior_args (), - sizeof (psargs) - strlen (psargs)); + char *string_end; + char *psargs_end = psargs + sizeof (psargs); + + /* linux_elfcore_write_prpsinfo () handles zero unterminated + strings fine. */ + string_end = memchr (psargs, 0, sizeof (psargs)); + if (string_end != NULL) + { + *string_end++ = ' '; + strncpy (string_end, get_inferior_args (), + psargs_end - string_end); + } } note_data = (char *) elfcore_write_prpsinfo (obfd, note_data,