Re: [Qemu-devel] [PATCH v8 08/13] dump: add API to write dump header

[Ekaterina Tumanova]

On 01/28/2014 10:22 AM, qiaonuohan wrote:
> the functions are used to write header of kdump-compressed format to vmcore.
> Header of kdump-compressed format includes:
> 1. common header: DiskDumpHeader32 / DiskDumpHeader64
> 2. sub header: KdumpSubHeader32 / KdumpSubHeader64
> 3. extra information: only elf notes here
...
> +static int create_header32(DumpState *s)
> +{
> +    int ret = 0;
> +    DiskDumpHeader32 *dh = NULL;
> +    KdumpSubHeader32 *kh = NULL;
> +    size_t size;
> +    int endian = s->dump_info.d_endian;
> +    uint32_t block_size;
> +    uint32_t sub_hdr_size;
> +    uint32_t bitmap_blocks;
> +    uint32_t status = 0;
> +    uint64_t offset_note;
> +
> +    /* write common header, the version of kdump-compressed format is 6th */
> +    size = sizeof(DiskDumpHeader32);
> +    dh = g_malloc0(size);
> +
> +    strncpy(dh->signature, KDUMP_SIGNATURE, strlen(KDUMP_SIGNATURE));

In this function the 3rd should argument should contain the length of
the destination argument (1st parameter).
If you place here the length of the 2nd parameter, this function call
becomes semantically the same as simple call to strcpy with all the
security implications...

There are more places like this.

Regards,
Kate.