Print this page
12786 fix CTF pointer overrun
Reviewed by: Toomas Soome <tsoome@me.com>
Reviewed by: Robert Mustacchi <rm@fingolfin.org>
Approved by: Dan McDonald <danmcd@joyent.com>


 116                                 ntype = ctf_type_resolve(fp, type);
 117                                 if (ntype == CTF_ERR || (ntype = fp->ctf_ptrtab[
 118                                     CTF_TYPE_TO_INDEX(ntype)]) == 0) {
 119                                         (void) ctf_set_errno(fp, ECTF_NOTYPE);
 120                                         goto err;
 121                                 }
 122                         }
 123 
 124                         type = CTF_INDEX_TO_TYPE(ntype,
 125                             (fp->ctf_flags & LCTF_CHILD));
 126 
 127                         q = p + 1;
 128                         continue;
 129                 }
 130 
 131                 if (isqualifier(p, (size_t)(q - p)))
 132                         continue; /* skip qualifier keyword */
 133 
 134                 for (lp = fp->ctf_lookups; lp->ctl_prefix != NULL; lp++) {
 135                         if (lp->ctl_prefix[0] == '\0' ||
 136                             strncmp(p, lp->ctl_prefix, (size_t)(q - p)) == 0) {

 137                                 for (p += lp->ctl_len; isspace(*p); p++)
 138                                         continue; /* skip prefix and next ws */
 139 
 140                                 if ((q = strchr(p, '*')) == NULL)
 141                                         q = end;  /* compare until end */
 142 
 143                                 while (isspace(q[-1]))
 144                                         q--;      /* exclude trailing ws */
 145 
 146                                 if ((hp = ctf_hash_lookup(lp->ctl_hash, fp, p,
 147                                     (size_t)(q - p))) == NULL) {
 148                                         (void) ctf_set_errno(fp, ECTF_NOTYPE);
 149                                         goto err;
 150                                 }
 151 
 152                                 type = hp->h_type;
 153                                 break;
 154                         }
 155                 }
 156 




 116                                 ntype = ctf_type_resolve(fp, type);
 117                                 if (ntype == CTF_ERR || (ntype = fp->ctf_ptrtab[
 118                                     CTF_TYPE_TO_INDEX(ntype)]) == 0) {
 119                                         (void) ctf_set_errno(fp, ECTF_NOTYPE);
 120                                         goto err;
 121                                 }
 122                         }
 123 
 124                         type = CTF_INDEX_TO_TYPE(ntype,
 125                             (fp->ctf_flags & LCTF_CHILD));
 126 
 127                         q = p + 1;
 128                         continue;
 129                 }
 130 
 131                 if (isqualifier(p, (size_t)(q - p)))
 132                         continue; /* skip qualifier keyword */
 133 
 134                 for (lp = fp->ctf_lookups; lp->ctl_prefix != NULL; lp++) {
 135                         if (lp->ctl_prefix[0] == '\0' ||
 136                             ((size_t)(q - p) >= lp->ctl_len && strncmp(p,
 137                             lp->ctl_prefix, (size_t)(q - p)) == 0)) {
 138                                 for (p += lp->ctl_len; isspace(*p); p++)
 139                                         continue; /* skip prefix and next ws */
 140 
 141                                 if ((q = strchr(p, '*')) == NULL)
 142                                         q = end;  /* compare until end */
 143 
 144                                 while (isspace(q[-1]))
 145                                         q--;      /* exclude trailing ws */
 146 
 147                                 if ((hp = ctf_hash_lookup(lp->ctl_hash, fp, p,
 148                                     (size_t)(q - p))) == NULL) {
 149                                         (void) ctf_set_errno(fp, ECTF_NOTYPE);
 150                                         goto err;
 151                                 }
 152 
 153                                 type = hp->h_type;
 154                                 break;
 155                         }
 156                 }
 157