DPDK patches and discussions
 help / color / mirror / Atom feed
From: Jan Viktorin <viktorin@rehivetech.com>
To: dev@dpdk.org
Cc: Jan Viktorin <viktorin@rehivetech.com>,
	David Marchand <david.marchand@6wind.com>,
	Thomas Monjalon <thomas.monjalon@6wind.com>
Subject: [dpdk-dev] [PATCH] app/test: fix +/-1 error in allocation
Date: Tue,  3 May 2016 21:15:27 +0200	[thread overview]
Message-ID: <1462302927-24627-1-git-send-email-viktorin@rehivetech.com> (raw)

A bug has been detected by valgrind:

==14406== Invalid write of size 1
==14406==    by 0x86ECC76: sprintf (in /usr/lib/libc-2.23.so)
==14406==    by 0x430B0A: commands_init (in /home/jviki/Projects/dpdk/dpdk-soc/build/app/test)
==14406==    by 0x42F215: main (in /home/jviki/Projects/dpdk/dpdk-soc/build/app/test)
==14406==  Address 0x9d72ff2 is 0 bytes after a block of size 1,346 alloc'd
==14406==    at 0x78C1BD0: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14406==    by 0x430AE4: commands_init (in /home/jviki/Projects/dpdk/dpdk-soc/build/app/test)
==14406==    by 0x42F215: main (in /home/jviki/Projects/dpdk/dpdk-soc/build/app/test)
==14406==

The commands buffer is exactly 1346 B long so there is an access just after
the buffer. The sprintf always writes '\0' at the end of the string. The '#'
separator adds 1 B more to each string. This is correct until the last string
is sprinted there. The last one is 1 B longer then expected, i.e.:

 strlen(t->command) + strlen("#") + ONE_FOR_ZERO

Fixes: 727909c59231 ("app/test: introduce dynamic commands list")

Signed-off-by: Jan Viktorin <viktorin@rehivetech.com>
---
 app/test/commands.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/test/commands.c b/app/test/commands.c
index 9cb9606..e0af8e4 100644
--- a/app/test/commands.c
+++ b/app/test/commands.c
@@ -439,7 +439,7 @@ int commands_init(void)
 		commands_len += strlen(t->command) + 1;
 	}
 
-	commands = malloc(commands_len);
+	commands = malloc(commands_len + 1);
 	if (!commands)
 		return -1;
 
-- 
2.8.0

             reply	other threads:[~2016-05-03 19:17 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-05-03 19:15 Jan Viktorin [this message]
2016-05-04  8:15 ` David Marchand
2016-05-25  8:35   ` Thomas Monjalon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1462302927-24627-1-git-send-email-viktorin@rehivetech.com \
    --to=viktorin@rehivetech.com \
    --cc=david.marchand@6wind.com \
    --cc=dev@dpdk.org \
    --cc=thomas.monjalon@6wind.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).