mirror of https://github.com/torvalds/linux.git
5714ca8cba
When dumping bitfield data, btf_dump_get_bitfield_value() reads data
based on the underlying type's size (t->size). However, it does not
verify that the provided data buffer (data_sz) is large enough to
contain these bytes.
If btf_dump__dump_type_data() is called with a buffer smaller than
the type's size, this leads to an out-of-bounds read. This was
confirmed by AddressSanitizer in the linked issue.
Fix this by ensuring we do not read past the provided data_sz limit.
Fixes:
|
||
|---|---|---|
| .. | ||
| api | ||
| bpf | ||
| perf | ||
| python | ||
| subcmd | ||
| symbol | ||
| thermal | ||
| argv_split.c | ||
| bitmap.c | ||
| cmdline.c | ||
| ctype.c | ||
| find_bit.c | ||
| hweight.c | ||
| list_sort.c | ||
| rbtree.c | ||
| slab.c | ||
| str_error_r.c | ||
| string.c | ||
| vsprintf.c | ||
| zalloc.c | ||