[Bug 1068] New: pmUnitsStr_r can clobber memory

[bugzilla-daemon@xxxxxxxxxxx]

Bug ID	1068
Summary	pmUnitsStr_r can clobber memory
Product	pcp
Version	unspecified
Hardware	All
OS	Linux
Status	NEW
Severity	major
Priority	P5
Component	pcp
Assignee	pcp@kenj.com.au
Reporter	fche@redhat.com
CC	pcp@oss.sgi.com
Classification	Unclassified

The way pmUnitsStr_r accumulates text fragments to create
the complete units text string ignores the incoming
string's buffer length to some extent and can
slightly smash the stack.

% cat foo.c

#include <pcp/pmapi.h>
#include <stdio.h>
#ifndef SIZE
#define SIZE 1
#endif
char buffer[SIZE];

void main() {
  pmUnits foo = {.dimSpace=7, .dimTime=-8, .dimCount=7,
                 .scaleSpace=PM_SPACE_TBYTE, .scaleTime=PM_TIME_USEC,
.scaleCount=7 };
  (void) pmUnitsStr_r(& foo, buffer, sizeof(buffer));
  printf ("%*s\n", sizeof(buffer), buffer);
}

% gcc foo.c -lpcp
% ./a.out
  / microsec^8
% valgring ./a.out
*** does not complain (on my f19 x86-64 box)

(just for reference:)
% gcc foo.c -lpcp -DSIZE=40
% ./a.out
Tbyte^7 count x 10^7^7 / microsec^8

(that ^7^7 part looks fishy too, btw).

---

      You are receiving this mail because:

• You are on the CC list for the bug.