From: Darrick J. Wong <darrick.wong@oracle.com>
Date: Tue, 2 May 2017 16:12:54 +0000 (-0500)
Subject: xfs_db: don't print arrays off the end of a buffer
X-Git-Tag: v4.11.0-rc2~4
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=966ef874a8920c238d24b45bd1e8697b8dfcd4da;p=thirdparty%2Fxfsprogs-dev.git

xfs_db: don't print arrays off the end of a buffer

Before printing an array, clamp the array count against the size of the
buffer so that we don't print random heap contents.

[sandeen: re-use fsz variable in call to prfunc]

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
---

diff --git a/db/print.c b/db/print.c
index e31372ff6..0da36c278 100644
--- a/db/print.c
+++ b/db/print.c
@@ -144,10 +144,19 @@ print_flist_1(
 			if (fl->flags & FL_OKHIGH)
 				count = min(count, fl->high - low + 1);
 			if (fa->prfunc) {
+				int	fsz;
+				int	bitlen;
+
+				/* Don't read an array off the end of the buffer */
+				fsz = fsize(f, iocur_top->data, parentoff, 0);
+				bitlen = iocur_top->len * NBBY;
+				if ((f->flags & FLD_ARRAY) &&
+				    fl->offset + (count * fsz) > bitlen) {
+					count = (bitlen - fl->offset) / fsz;
+				}
+
 				neednl = fa->prfunc(iocur_top->data, fl->offset,
-					count, fa->fmtstr,
-					fsize(f, iocur_top->data, parentoff, 0),
-					fa->arg, low,
+					count, fa->fmtstr, fsz, fa->arg, low,
 					(f->flags & FLD_ARRAY) != 0);
 				if (neednl)
 					dbprintf("\n");