valgrind detects the following invalid write on the call of strcpy():
==22674== Invalid write of size 1
==22674== at 0x483CCFE: strcpy (vg_replace_strmem.c:511)
==22674== by 0x47202B: extract_hex (tools.c:1152)
==22674== by 0x5104ED: search_for_switch_to (x86_64.c:6342)
==22674== by 0x51D6EE: x86_64_thread_return_init (x86_64.c:6368)
==22674== by 0x51D6EE: x86_64_init (x86_64.c:721)
==22674== by 0x464A2D: main_loop (main.c:770)
==22674== by 0x6BF1B2: captured_command_loop (main.c:258)
==22674== by 0x6BD7B9: catch_errors (exceptions.c:557)
==22674== by 0x6C0235: captured_main (main.c:1064)
==22674== by 0x6BD7B9: catch_errors (exceptions.c:557)
==22674== by 0x6C04E6: gdb_main (main.c:1079)
==22674== by 0x6C04E6: gdb_main_entry (main.c:1099)
==22674== by 0x46316F: main (main.c:708)
==22674== Address 0x2b439eb8 is 0 bytes after a block of size 40 alloc'd
==22674== at 0x483BAE9: calloc (vg_replace_malloc.c:760)
==22674== by 0x471794: getbuf (tools.c:6036)
==22674== by 0x47201D: extract_hex (tools.c:1151)
==22674== by 0x5104ED: search_for_switch_to (x86_64.c:6342)
==22674== by 0x51D6EE: x86_64_thread_return_init (x86_64.c:6368)
==22674== by 0x51D6EE: x86_64_init (x86_64.c:721)
==22674== by 0x464A2D: main_loop (main.c:770)
==22674== by 0x6BF1B2: captured_command_loop (main.c:258)
==22674== by 0x6BD7B9: catch_errors (exceptions.c:557)
==22674== by 0x6C0235: captured_main (main.c:1064)
==22674== by 0x6BD7B9: catch_errors (exceptions.c:557)
==22674== by 0x6C04E6: gdb_main (main.c:1079)
==22674== by 0x6C04E6: gdb_main_entry (main.c:1099)
==22674== by 0x46316F: main (main.c:708)
This is due to strcpy() receives empty string in its 1st argument
because the size of the buffer associated with buf variable then is of
size 0 due to lack of consideration of the terminal '\0' byte.
Fix this by +1 to the buffer size for the terminal '\0' byte.
Signed-off-by: HATAYAMA Daisuke <d.hatayama@xxxxxxxxxxx>
---
tools.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools.c b/tools.c
index 91d5baf..8050d30 100644
--- a/tools.c
+++ b/tools.c
@@ -1150,7 +1150,7 @@ extract_hex(char *s, ulong *result, char stripchar, ulong first_instance)
ulong value;
char *buf;
- buf = GETBUF(strlen(s));
+ buf = GETBUF(strlen(s) + 1);
strcpy(buf, s);
argc = parse_line(buf, arglist);
--
1.8.3.1
--
Crash-utility mailing list
Crash-utility@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/crash-utility
