From 099538fd51014e98a732c821d9f3824f857cfcc3 Mon Sep 17 00:00:00 2001 From: lilu Date: Mon, 27 Jul 2026 14:06:02 +0800 Subject: [PATCH] libpcp: fix heap buffer over-read in __pmLogLoadLabelSet --- src/libpcp/src/e_labels.c | 15 +++++++++++++++ src/libpcp3/src/e_labels.c | 15 +++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/src/libpcp/src/e_labels.c b/src/libpcp/src/e_labels.c index 342cb9163de..6100ca95250 100644 --- a/src/libpcp/src/e_labels.c +++ b/src/libpcp/src/e_labels.c @@ -242,6 +242,11 @@ __pmLogLoadLabelSet(char *tbuf, int rlen, int rtype, __pmTimestamp *stamp, } for (i = 0; i < nsets; i++) { + if (k + 2*sizeof(__int32_t) > rlen) { + sts = PM_ERR_LOGREC; + free(labelsets); + return sts; + } inst = *((unsigned int*)&tbuf[k]); inst = ntohl(inst); k += sizeof(inst); @@ -260,6 +265,11 @@ __pmLogLoadLabelSet(char *tbuf, int rlen, int rtype, __pmTimestamp *stamp, return sts; } + if (k + jsonlen > rlen) { + free(labelsets); + return PM_ERR_LOGREC; + } + if ((labelsets[i].json = (char *)malloc(jsonlen+1)) == NULL) { sts = -oserror(); free(labelsets); @@ -271,6 +281,11 @@ __pmLogLoadLabelSet(char *tbuf, int rlen, int rtype, __pmTimestamp *stamp, k += jsonlen; /* label nlabels */ + if (k + sizeof(__int32_t) > rlen) { + free(labelsets[i].json); + free(labelsets); + return PM_ERR_LOGREC; + } nlabels = ntohl(*((unsigned int *)&tbuf[k])); k += sizeof(nlabels); labelsets[i].nlabels = nlabels; diff --git a/src/libpcp3/src/e_labels.c b/src/libpcp3/src/e_labels.c index 8e94a112b0b..c1d0f8f0e58 100644 --- a/src/libpcp3/src/e_labels.c +++ b/src/libpcp3/src/e_labels.c @@ -247,6 +247,11 @@ __pmLogLoadLabelSet(char *tbuf, int rlen, int rtype, __pmTimestamp *stamp, } for (i = 0; i < nsets; i++) { + if (k + 2*sizeof(__int32_t) > rlen) { + sts = PM_ERR_LOGREC; + free(labelsets); + return sts; + } inst = *((unsigned int*)&tbuf[k]); inst = ntohl(inst); k += sizeof(inst); @@ -265,6 +270,11 @@ __pmLogLoadLabelSet(char *tbuf, int rlen, int rtype, __pmTimestamp *stamp, return sts; } + if (k + jsonlen > rlen) { + free(labelsets); + return PM_ERR_LOGREC; + } + if ((labelsets[i].json = (char *)malloc(jsonlen+1)) == NULL) { sts = -oserror(); free(labelsets); @@ -276,6 +286,11 @@ __pmLogLoadLabelSet(char *tbuf, int rlen, int rtype, __pmTimestamp *stamp, k += jsonlen; /* label nlabels */ + if (k + sizeof(__int32_t) > rlen) { + free(labelsets[i].json); + free(labelsets); + return PM_ERR_LOGREC; + } nlabels = ntohl(*((unsigned int *)&tbuf[k])); k += sizeof(nlabels); labelsets[i].nlabels = nlabels;