diff options
| author | Greg Kaiser <gkaiser@google.com> | 2018-03-23 14:16:12 -0700 |
|---|---|---|
| committer | Greg Kaiser <gkaiser@google.com> | 2018-03-27 21:59:31 +0000 |
| commit | d6d847142bb38caead1e180b6611e413f905b016 (patch) | |
| tree | 6003dbfebb29ba61462347a4935314f56bbb6245 /lmkd | |
| parent | 677bed578eba29b47b9675c5b3e89f58390db947 (diff) | |
| download | system_core-d6d847142bb38caead1e180b6611e413f905b016.tar.gz system_core-d6d847142bb38caead1e180b6611e413f905b016.tar.bz2 system_core-d6d847142bb38caead1e180b6611e413f905b016.zip | |
lmkd: Protect against buffer overflow
We're passing a 'line' whose backing buffer is PAGE_MAX in size
into memory_stat_parse_line(). We protect overflowing the smaller
LINE_MAX 'key' buffer via some C preprocessing macros to assure
we limit the size.
Test: Local build with LMKD_LOG_STATS set for this file.
Bug: 76220622
Merged-In: I9e50d4270f7099e37a9bfc7fb9b9b95cc7adb086
Change-Id: I9e50d4270f7099e37a9bfc7fb9b9b95cc7adb086
Diffstat (limited to 'lmkd')
| -rw-r--r-- | lmkd/lmkd.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/lmkd/lmkd.c b/lmkd/lmkd.c index e2e5c4e37..ee2f343d9 100644 --- a/lmkd/lmkd.c +++ b/lmkd/lmkd.c @@ -75,6 +75,9 @@ #define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x))) #define EIGHT_MEGA (1 << 23) +#define STRINGIFY(x) STRINGIFY_INTERNAL(x) +#define STRINGIFY_INTERNAL(x) #x + /* default to old in-kernel interface if no memory pressure events */ static int use_inkernel_interface = 1; static bool has_inkernel_module; @@ -555,10 +558,10 @@ static void ctrl_connect_handler(int data __unused, uint32_t events __unused) { #ifdef LMKD_LOG_STATS static void memory_stat_parse_line(char *line, struct memory_stat *mem_st) { - char key[LINE_MAX]; + char key[LINE_MAX + 1]; int64_t value; - sscanf(line,"%s %" SCNd64 "", key, &value); + sscanf(line, "%" STRINGIFY(LINE_MAX) "s %" SCNd64 "", key, &value); if (strcmp(key, "total_") < 0) { return; |