averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

tools lib api: Fix missing null termination in filename__read_int/ull()

Browse Source 
[ Upstream commit 52b1f96784 ]

filename__read_int() passes a stack buffer to read() using the full
sizeof(line) and then hands it to atoi() without null-terminating.
If a sysfs file fills the 64-byte buffer exactly, atoi() reads past
the array into uninitialized stack memory.

filename__read_ull_base() has the same issue with strtoull().

Fix both by reading sizeof(line) - 1 bytes and explicitly
null-terminating after a successful read.

Fixes: 3a351127cb ("tools lib fs: Adopt filename__read_int from tools/perf/")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Arnaldo Carvalho de Melo
2026-07-24 16:03:17 +02:00
committed by Greg Kroah-Hartman
parent 05457b1241
commit 20a17dd8a0
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/lib/api/fs/fs.c
+8 -2
View File
@@ -293,11 +293,14 @@ int filename__read_int(const char *filename, int *value)
{
char line[64];
int fd = open(filename, O_RDONLY), err = -1;
ssize_t n;
if (fd < 0)
return -1;
if (read(fd, line, sizeof(line)) > 0) {
n = read(fd, line, sizeof(line) - 1);
if (n > 0) {
line[n] = '\0';
*value = atoi(line);
err = 0;
}
@@ -311,11 +314,14 @@ static int filename__read_ull_base(const char *filename,
{
char line[64];
int fd = open(filename, O_RDONLY), err = -1;
ssize_t n;
if (fd < 0)
return -1;
if (read(fd, line, sizeof(line)) > 0) {
n = read(fd, line, sizeof(line) - 1);
if (n > 0) {
line[n] = '\0';
*value = strtoull(line, NULL, base);
if (*value != ULLONG_MAX)
err = 0;