portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix few sscanf issues reported by @yeggor (#3428)

Browse source
This commit is contained in:
Riccardo Schirone 2023-03-22 11:36:54 +01:00 committed by GitHub
parent 8c9568e733
commit 65e4e9ebd1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 34 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
librz/debug/p/debug_native.c
View file

@ -86,6 +86,14 @@ RZ_API RzList *rz_w32_dbg_maps(RzDebug *);
/* begin of debugger code */
#if DEBUGGER
#define PROC_NAME_SZ 1024
#define PROC_REGION_SZ 100
// PROC_REGION_SZ - 2 (used for `0x`). Due to how RZ_STR_DEF works this can't be
// computed.
#define PROC_REGION_LEFT_SZ 98
#define PROC_PERM_SZ 5
#define PROC_UNKSTR_SZ 128
#if !__WINDOWS__ && !(__linux__ && !defined(WAIT_ON_ALL_CHILDREN)) && !__APPLE__
static int rz_debug_handle_signals(RzDebug *dbg) {
#if __KFBSD__ || __NetBSD__
@ -990,7 +998,7 @@ static RzList /*<RzDebugMap *>*/ *rz_debug_native_map_get(RzDebug *dbg) {
RzList *list = NULL;
#if __KFBSD__
int ign;
char unkstr[128];
char unkstr[PROC_UNKSTR_SZ + 1];
#endif
#if __APPLE__
list = xnu_dbg_maps(dbg, 0);
@ -1006,8 +1014,8 @@ static RzList /*<RzDebugMap *>*/ *rz_debug_native_map_get(RzDebug *dbg) {
RzDebugMap *map;
int i, perm, unk = 0;
char *pos_c;
char path[1024], line[1024], name[1024];
char region[100], region2[100], perms[5];
char path[1024], line[1024], name[PROC_NAME_SZ + 1];
char region[PROC_REGION_SZ + 1], region2[PROC_REGION_SZ + 1], perms[PROC_PERM_SZ + 1];
FILE *fd;
if (dbg->pid == -1) {
// eprintf ("rz_debug_native_map_get: No selected pid (-1)\n");
@ -1063,7 +1071,7 @@ static RzList /*<RzDebugMap *>*/ *rz_debug_native_map_get(RzDebug *dbg) {
}
#if __KFBSD__
// 0x8070000 0x8072000 2 0 0xc1fde948 rw- 1 0 0x2180 COW NC vnode /usr/bin/gcc
if (sscanf(line, "%s %s %d %d 0x%s %3s %d %d",
if (sscanf(line, "%" RZ_STR_DEF(PROC_REGION_LEFT_SZ) "s %" RZ_STR_DEF(PROC_REGION_LEFT_SZ) "s %d %d 0x%" RZ_STR_DEF(PROC_UNKSTR_SZ) "s %3s %d %d",
&region[2], &region2[2], &ign, &ign,
unkstr, perms, &ign, &ign) != 8) {
eprintf("%s: Unable to parse \"%s\"\n", __func__, path);
@ -1082,7 +1090,7 @@ static RzList /*<RzDebugMap *>*/ *rz_debug_native_map_get(RzDebug *dbg) {
ut64 offset = 0;
;
// 7fc8124c4000-7fc81278d000 r--p 00000000 fc:00 17043921 /usr/lib/locale/locale-archive
i = sscanf(line, "%s %s %08" PFMT64x " %*s %*s %[^\n]", &region[2], perms, &offset, name);
i = sscanf(line, "%" RZ_STR_DEF(PROC_REGION_LEFT_SZ) "s %" RZ_STR_DEF(PROC_PERM_SZ) "s %08" PFMT64x " %*s %*s %" RZ_STR_DEF(PROC_NAME_SZ) "[^\n]", &region[2], perms, &offset, name);
if (i == 3) {
name[0] = '\0';
} else if (i != 4) {

14
librz/debug/p/native/linux/linux_coredump.c
View file

@ -34,6 +34,8 @@ typedef ut64 elf_offset_t;
#define round_up(a) ((((a) + (4) - (1)) / (4)) * (4))
#define sizeof_round_up(b) round_up(sizeof(b))
#define NO_STR_SZ 128
static map_file_t mapping_file = { 0, 0 };
static note_info_t note_info[NT_LENGHT_T];
@ -141,13 +143,13 @@ static proc_per_thread_t *get_proc_thread_content(int pid, int tid) {
return NULL;
}
{
char no_str[128];
char no_str[NO_STR_SZ + 1];
long unsigned int no_lui;
int no_num;
char no_char;
ut32 no_ui;
sscanf(buff, "%d %s %c %d %d %d %d %d %u %lu %lu %lu %lu"
"%" PFMT64x " %" PFMT64x " %ld %lu",
sscanf(buff, "%d %" RZ_STR_DEF(NO_STR_SZ) "s %c %d %d %d %d %d %u %lu %lu %lu %lu"
"%" PFMT64x " %" PFMT64x " %ld %lu",
&no_num, no_str, &no_char, &no_num, &no_num, &no_num,
&no_num, &no_num, &no_ui, &no_lui, &no_lui, &no_lui,
&no_lui, &t->utime, &t->stime, &t->cutime, &t->cstime);
@ -796,12 +798,12 @@ static proc_per_process_t *get_proc_process_content(RzDebug *dbg) {
/* /proc/[pid]/stat */
/* we only need few fields which are process-wide */
{
char no_str[128];
char no_str[NO_STR_SZ + 1];
long unsigned int no_lui;
long int no_li;
int no_num;
sscanf(buff, "%d %s %c %d %d %d %d %d %u %lu %lu %lu %lu"
"%lu %lu %ld %ld %ld %ld %ld",
sscanf(buff, "%d %" RZ_STR_DEF(NO_STR_SZ) "s %c %d %d %d %d %d %u %lu %lu %lu %lu"
"%lu %lu %ld %ld %ld %ld %ld",
&p->pid, no_str, &p->s_name, &p->ppid, &p->pgrp, &no_num,
&no_num, &p->sid, &p->flag, &no_lui, &no_lui, &no_lui,
&no_lui, &no_lui, &no_lui, &no_li, &no_li,

18
librz/io/p/io_self.c
View file

@ -56,6 +56,13 @@ typedef struct {
int perm;
} RzIOSelfSection;
#define PROC_NAME_SZ 1024
#define PROC_REGION_SZ 100
// PROC_REGION_SZ - 2 (used for `0x`). Due to how RZ_STR_DEF works this can't be
// computed.
#define PROC_REGION_LEFT_SZ 98
#define PROC_PERM_SZ 5
static RzIOSelfSection self_sections[1024];
static int self_sections_count = 0;
static bool mameio = false;
@ -91,8 +98,8 @@ static int update_self_regions(RzIO *io, int pid) {
#elif __linux__
char *pos_c;
int i, l, perm;
char path[1024], line[1024];
char region[100], region2[100], perms[5];
char path[1024], line[1024], name[PROC_NAME_SZ + 1];
char region[PROC_REGION_SZ + 1], region2[PROC_REGION_SZ + 1], perms[PROC_PERM_SZ + 1];
snprintf(path, sizeof(path) - 1, "/proc/%d/maps", pid);
FILE *fd = rz_sys_fopen(path, "r");
if (!fd) {
@ -107,8 +114,9 @@ static int update_self_regions(RzIO *io, int pid) {
if (line[0] == '\0') {
break;
}
path[0] = '\0';
sscanf(line, "%s %s %*s %*s %*s %[^\n]", region + 2, perms, path);
name[0] = '\0';
sscanf(line, "%" RZ_STR_DEF(PROC_REGION_LEFT_SZ) "s %" RZ_STR_DEF(PROC_PERM_SZ) "s %*s %*s %*s %" RZ_STR_DEF(PROC_NAME_SZ) "[^\n]",
region + 2, perms, name);
memcpy(region, "0x", 2);
pos_c = strchr(region + 2, '-');
if (pos_c) {
@ -130,7 +138,7 @@ static int update_self_regions(RzIO *io, int pid) {
}
self_sections[self_sections_count].from = rz_num_get(NULL, region);
self_sections[self_sections_count].to = rz_num_get(NULL, region2);
self_sections[self_sections_count].name = strdup(path);
self_sections[self_sections_count].name = strdup(name);
self_sections[self_sections_count].perm = perm;
self_sections_count++;
rz_num_get(NULL, region2);