Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Fix a couple of buffer overrun hazards. #1137

Merged
merged 4 commits into from
Apr 14, 2021
Merged

fix: Fix a couple of buffer overrun hazards. #1137

merged 4 commits into from
Apr 14, 2021

Conversation

bmah888
Copy link
Contributor

@bmah888 bmah888 commented Apr 10, 2021

Pointed out by @berkakinci.

Fixes #1134.

PLEASE NOTE the following text from the iperf3 license. Submitting a
pull request to the iperf3 repository constitutes "[making]
Enhancements available...publicly":

You are under no obligation whatsoever to provide any bug fixes, patches, or
upgrades to the features, functionality or performance of the source code
("Enhancements") to anyone; however, if you choose to make your Enhancements
available either publicly, or directly to Lawrence Berkeley National
Laboratory, without imposing a separate written license agreement for such
Enhancements, then you hereby grant the following license: a non-exclusive,
royalty-free perpetual license to install, use, modify, prepare derivative
works, incorporate into other computer software, distribute, and sublicense
such enhancements or derivative works thereof, in binary and source code form.

The complete iperf3 license is available in the LICENSE file in the
top directory of the iperf3 source tree.

Copy link

@berkakinci berkakinci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This part is fixed: now linebuffer[1024] won't overflow.
On setting r and return r:
Under test->role == 'c' There is another couple of missing counts at line 4548 and 4551.
The rest of this is getting in the weeds and would require a bunch of little changes: all of these functions can return -1 on failure, so count wouldn't be correct. Also, the *nprint* functions return the number that would have been written if the buffer was large enough, so count wouldn't be correct if buffers weren't large enough.
If you're not averse to a bigger change: I think both the role == 'c' and role == 's' stanzas can share a lot more code. Set up linebuffer in both cases. Then only take the return value from a final (and single) fprintf() call.

In theory this check should always succeed, given the relative
buffer sizes as currently coded.
@bmah888
Copy link
Contributor Author

bmah888 commented Apr 14, 2021

The attempt to merge this pull request went sideways. Completely my fault. I ended up backing it out and then cherry-picking the individual commits one by one back onto the mainline.

@bmah888 bmah888 deleted the issue-1134 branch April 16, 2021 18:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Buffer overflow hazard and incorrect return value in iperf_printf().
2 participants