Skip to content

Commit d40125f

Browse files
committed
plugins/ocp: fix telemetry parser buffer overflow
The fixed 256-byte description_str will overflow for any reasonably sized data_size >= 128. Max data_size is for OCP VU Event Data is 0xFF Dwords, so the buffer should be at least 1020 bytes + 1 for null. 1024 seems like a nice number for OCP. Reported-by: Nate Thornton <[email protected]> Signed-off-by: Daniel Wagner <[email protected]>
1 parent eea4913 commit d40125f

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

util/utils.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -138,18 +138,18 @@ unsigned char *read_binary_file(char *data_dir_path, const char *bin_path,
138138

139139
void print_formatted_var_size_str(const char *msg, const __u8 *pdata, size_t data_size, FILE *fp)
140140
{
141-
char description_str[256] = "";
141+
char description_str[1024] = "";
142142
char temp_buffer[3] = { 0 };
143143

144144
for (size_t i = 0; i < data_size; ++i) {
145145
sprintf(temp_buffer, "%02X", pdata[i]);
146146
strcat(description_str, temp_buffer);
147147
}
148148

149-
if (fp)
150-
fprintf(fp, "%s: %s\n", msg, description_str);
151-
else
152-
printf("%s: %s\n", msg, description_str);
149+
if (!fp)
150+
fp = stdout;
151+
152+
fprintf(fp, "%s: %s\n", msg, description_str);
153153
}
154154

155155
void process_field_size_16(int offset, char *sfield, __u8 *buf, char *datastr)

0 commit comments

Comments
 (0)