diff options
| author | Dmitry Safonov <dsafonov@virtuozzo.com> | 2017-02-06 13:14:12 +0300 |
|---|---|---|
| committer | Andrei Vagin <avagin@virtuozzo.com> | 2017-03-15 09:36:04 +0300 |
| commit | beed3195500bf49b955d6d9585041745a328a907 (patch) | |
| tree | 7b08b532e83b5b03302f171ed46febc51869a629 /compel/src | |
| parent | af73eda388a126c00ccdc2ec34881db059642d80 (diff) | |
compel/infect: fix out-of-bounds parasite memcpy()
We need to copy only parasite, do copy page-aligned size,
which will copy part of CRIU binary, that follows parasite
blob. That will cross red-zones and fire asan error.
travis-ci: success for series starting with [1/6] compel/infect: fix out-of-bounds parasite memcpy()
Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
Diffstat (limited to 'compel/src')
| -rw-r--r-- | compel/src/lib/infect.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/compel/src/lib/infect.c b/compel/src/lib/infect.c index b8997a40d..7e1da8fa9 100644 --- a/compel/src/lib/infect.c +++ b/compel/src/lib/infect.c @@ -858,7 +858,7 @@ static inline unsigned long total_pie_size(size_t blob_size, size_t nr_gp) int compel_infect(struct parasite_ctl *ctl, unsigned long nr_threads, unsigned long args_size) { int ret; - unsigned long p, map_exchange_size, pie_size, parasite_size = 0; + unsigned long p, map_exchange_size, parasite_size = 0; if (ctl->pblob.parasite_type != COMPEL_BLOB_CHEADER) goto err; @@ -876,7 +876,7 @@ int compel_infect(struct parasite_ctl *ctl, unsigned long nr_threads, unsigned l * without using ptrace at all. */ - pie_size = parasite_size = total_pie_size(ctl->pblob.hdr.bsize, ctl->pblob.hdr.nr_gotpcrel); + parasite_size = total_pie_size(ctl->pblob.hdr.bsize, ctl->pblob.hdr.nr_gotpcrel); ctl->args_size = round_up(args_size, PAGE_SIZE); parasite_size += ctl->args_size; @@ -896,7 +896,7 @@ int compel_infect(struct parasite_ctl *ctl, unsigned long nr_threads, unsigned l ctl->addr_cmd = ctl->local_map + ctl->pblob.hdr.addr_cmd_off; ctl->addr_args = ctl->local_map + ctl->pblob.hdr.addr_arg_off; - memcpy(ctl->local_map, ctl->pblob.hdr.mem, pie_size); + memcpy(ctl->local_map, ctl->pblob.hdr.mem, ctl->pblob.hdr.bsize); if (ctl->pblob.hdr.nr_relocs) compel_relocs_apply(ctl->local_map, ctl->remote_map, ctl->pblob.hdr.bsize, ctl->pblob.hdr.relocs, ctl->pblob.hdr.nr_relocs); |