libpcp: reject undersized metadata records in __pmLogLoadMeta

qa/2009

@@ -0,0 +1,87 @@
+#!/bin/sh
+# PCP QA Test No. 2009
+# __pmLogLoadMeta: reject undersized metadata records.
+#
+# Crafted archives with a record length below the minimum for the declared
+# type must fail cleanly with PM_ERR_LOGREC ("Corrupted record"), not
+# underflow rlen into a huge allocation or read past the record body.
+#
+# Copyright (c) 2026 Red Hat.  All Rights Reserved.
+#
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+. ./common.product
+. ./common.filter
+. ./common.check
+
+which python3 >/dev/null 2>&1 || _notrun "no python3 binary installed"
+
+status=1	# failure is the default!
+trap "cd $here; rm -rf $tmp; exit \$status" 0 1 2 3 15
+mkdir $tmp
+
+_filter()
+{
+    sed -e "s;$tmp;TMP;g"
+}
+
+# Build an archive whose .meta has a valid V2 label followed by a single
+# crafted metadata header (len, type) and a little padding.  Data/index
+# come from archives/ok-foo so volume labels stay consistent.
+#
+_make_badmeta()
+{
+    _len="$1"
+    _type="$2"
+    _out="$3"
+
+    dd if=archives/ok-foo.meta bs=1 count=132 of=$_out.meta 2>/dev/null
+    python3 -c "
+import struct, sys
+# big-endian __pmLogHdr: len + type, plus padding so the header read
+# does not sit exactly at EOF
+sys.stdout.buffer.write(struct.pack('>II', $_len, $_type) + bytes(32))
+" >>$_out.meta
+    cp archives/ok-foo.0 $_out.0
+    cp archives/ok-foo.index $_out.index
+}
+
+# real QA test starts here
+
+echo "=== control: unmodified archives/ok-foo opens ==="
+if pmdumplog -l archives/ok-foo >/dev/null 2>&1
+then
+    echo OK
+else
+    echo FAILED
+fi
+
+echo
+echo "=== undersized metadata records (expect Corrupted record) ==="
+# TYPE_LABEL (7) and TYPE_TEXT (4) used to pass a negative/tiny rlen to
+# malloc() or parse past the payload; TYPE_DESC (1) ignored rlen and could
+# read past the declared record.  Lengths 1..11 fail the rlen <= 0 check
+# (body too small for header+trailer).  Lengths 12..19 have a non-negative
+# but still undersized body for these record types.
+for type in 7 4 1
+do
+    case $type
+    in
+	1) tname=TYPE_DESC ;;
+	4) tname=TYPE_TEXT ;;
+	7) tname=TYPE_LABEL ;;
+    esac
+    for len in 1 4 8 11 12 13 14 15 16 17 18 19
+    do
+	echo
+	echo "--- len=$len $tname ---"
+	_make_badmeta $len $type $tmp/bad
+	pmdumplog -l $tmp/bad 2>&1 | _filter
+    done
+done
+
+# success, all done
+status=0
+exit

qa/2009.out

@@ -0,0 +1,113 @@
+QA output created by 2009
+=== control: unmodified archives/ok-foo opens ===
+OK
+
+=== undersized metadata records (expect Corrupted record) ===
+
+--- len=1 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=4 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=8 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=11 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=12 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=13 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=14 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=15 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=16 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=17 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=18 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=19 TYPE_LABEL ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=1 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=4 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=8 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=11 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=12 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=13 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=14 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=15 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=16 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=17 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=18 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=19 TYPE_TEXT ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=1 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=4 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=8 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=11 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=12 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=13 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=14 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=15 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=16 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=17 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=18 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive
+
+--- len=19 TYPE_DESC ---
+pmdumplog: Cannot open archive "TMP/bad": Corrupted record in a PCP archive

qa/group

@@ -2406,5 +2406,6 @@ suse
 2001 pmda.btrfs local
 2002 pmda.db2 local
 2008 libpcp labels local
+2009 libpcp archive local
 4751 libpcp threads valgrind local pcp helgrind
 9000 other local