pcp
[Top] [All Lists]

memory corruption bug fix, libpcp p_instance.c

To: pcp developers <pcp@xxxxxxxxxxx>
Subject: memory corruption bug fix, libpcp p_instance.c
From: "Frank Ch. Eigler" <fche@xxxxxxxxxx>
Date: Mon, 2 Mar 2015 18:51:42 -0500
Delivered-to: pcp@xxxxxxxxxxx
User-agent: Mutt/1.4.2.2i
Hi -

The new pdubuf implementation has collected its first scalp: an
ancient memory-corruption bug in libpcp.  Suggest cherry-picking
this commit from fche/multithread.

The following one-liner reproduces the problem, but I couldn't
pick a favorite qa/NNN to plop that into.  Any nominations from
the Academy?

valgrind pmval 'pmcd.buf.alloc' -i \
  `awk 'BEGIN { for (i=0;i<3000;i++) { printf "x" }; printf("\n"); }'`


commit 0629116e49c70c5e3d86570807c563158ccf576d
Author: Frank Ch. Eigler <fche@xxxxxxxxxx>
Date:   Mon Mar 2 18:32:20 2015 -0500

    libpcp memory corruption bug: __pmSendInstanceReq doing __pmFindPDU too 
small
    
    An exact-size __pmFindPDU malloc implementation found this bug in
    p_instance.c, wherein the `sizeof(need)' rather than `need' was
    passed.  This corrupted memory behind the declared region, but the
    problem was hidden because the clasical __pmFindPDU rounded up memory
    allocations to 1K+, but large indom-name queries can trigger it.


<Prev in Thread] Current Thread [Next in Thread>