maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

T bugfix: include size of 'length' to allocated memory

Browse Source 
The way allocation is done (granularity of 64KiB) makes a crash more
difficult to achieve, but if a trace is exactly 64KiB, we miss 4 bytes
in the realloc and then anything may happen.
This commit is contained in:
Cedric Roux
2025-06-02 11:19:23 +02:00
parent bab05384a4
commit 2fa337d853
5 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/utils/T/tracer/extract_config.c
+2 -2
View File
@@ -46,8 +46,8 @@ int main(int n, char **v)
/* read event from file */
if (fread(&length, 4, 1, in) != 1) break;
if (ebuf.omaxsize < length) {
ebuf.omaxsize = (length + 65535) & ~65535;
if (ebuf.omaxsize < length + 4) {
ebuf.omaxsize = (length + 4 + 65535) & ~65535;
ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
}
common/utils/T/tracer/hacks/multi-rru-clean.c
+2 -2
View File
@@ -157,8 +157,8 @@ int main(int n, char **v)
/* read event from file */
if (fread(&length, 4, 1, in) != 1) break;
if (ebuf.omaxsize < length) {
ebuf.omaxsize = (length + 65535) & ~65535;
if (ebuf.omaxsize < length + 4) {
ebuf.omaxsize = (length + 4 + 65535) & ~65535;
ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
}
common/utils/T/tracer/multi.c
+2 -2
View File
@@ -114,8 +114,8 @@ int read_tracee(int s, OBUF *ebuf, int *_type, int32_t *_length)
int vpos = 0;
if (fullread(s, &length, 4) == -1) return -1;
if (ebuf->omaxsize < length) {
ebuf->omaxsize = (length + 65535) & ~65535;
if (ebuf->omaxsize < length + 4) {
ebuf->omaxsize = (length + 4 + 65535) & ~65535;
ebuf->obuf = realloc(ebuf->obuf, ebuf->omaxsize);
if (ebuf->obuf == NULL) { printf("out of memory\n"); exit(1); }
}
common/utils/T/tracer/record.c
+2 -2
View File
@@ -133,8 +133,8 @@ int main(int n, char **v)
int vpos = 0;
if (fullread(socket, &length, 4) == -1) goto read_error;
if (ebuf.omaxsize < length) {
ebuf.omaxsize = (length + 65535) & ~65535;
if (ebuf.omaxsize < length + 4) {
ebuf.omaxsize = (length + 4 + 65535) & ~65535;
ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
}
common/utils/T/tracer/replay.c
+2 -2
View File
@@ -146,8 +146,8 @@ int main(int n, char **v)
/* read event from file */
if (fread(&length, 4, 1, in) != 1) break;
if (ebuf.omaxsize < length) {
ebuf.omaxsize = (length + 65535) & ~65535;
if (ebuf.omaxsize < length + 4) {
ebuf.omaxsize = (length + 4 + 65535) & ~65535;
ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
}