git: 1bf7ee1ab5df - stable/13 - dtrace: fix an out of bound read and a NULL pointer increment

[Mark Johnston]

The branch stable/13 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=1bf7ee1ab5df1c0b8083f8f3b63037c1d72af387

commit 1bf7ee1ab5df1c0b8083f8f3b63037c1d72af387
Author:     Domagoj Stolfa <domagoj.stolfa at gmail.com>
AuthorDate: 2021-06-17 17:35:33 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-06-24 13:04:54 +0000

    dtrace: fix an out of bound read and a NULL pointer increment
    
    In dt_cc.c when the provider is an empty string, accessing
    strlen(pdp->dtpd_provider) - 1 will result in a pdp->dtpd_provider[-1]
    access.
    
    Similarly, in dt_ident.c, if p2 is a NULL pointer, doing a p2++ on it is
    undefined behaviour.
    
    Reviewed by:    markj
    Sponsored by:   Google
    
    (cherry picked from commit a877965fa3da218bceaaa0f51c4d7770e64e6df0)
---
 cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c    | 6 +++++-
 cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c | 4 +++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c
index 8ec5dd61b8ee..e63771c91e08 100644
--- a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c
+++ b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c
@@ -1691,6 +1691,7 @@ dt_setcontext(dtrace_hdl_t *dtp, dtrace_probedesc_t *pdp)
 	dt_ident_t *idp;
 	char attrstr[8];
 	int err;
+	size_t prov_len;
 
 	/*
 	 * Both kernel and pid based providers are allowed to have names
@@ -1704,7 +1705,10 @@ dt_setcontext(dtrace_hdl_t *dtp, dtrace_probedesc_t *pdp)
 	 * On an error, dt_pid_create_probes() will set the error message
 	 * and tag -- we just have to longjmp() out of here.
 	 */
-	if (isdigit(pdp->dtpd_provider[strlen(pdp->dtpd_provider) - 1]) &&
+
+	prov_len = strlen(pdp->dtpd_provider);
+
+	if ((prov_len > 0 && isdigit(pdp->dtpd_provider[prov_len - 1])) &&
 	    ((pvp = dt_provider_lookup(dtp, pdp->dtpd_provider)) == NULL ||
 	    pvp->pv_desc.dtvd_priv.dtpp_flags & DTRACE_PRIV_PROC) &&
 	    dt_pid_create_probes(pdp, dtp, yypcb) != 0) {
diff --git a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c
index b9164ac26cf9..5ff772be041d 100644
--- a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c
+++ b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_ident.c
@@ -210,8 +210,10 @@ dt_idcook_func(dt_node_t *dnp, dt_ident_t *idp, int argc, dt_node_t *args)
 			}
 		}
 
-		for (p2 = strchr(p2, ','); p2++ != NULL; i++)
+		for (p2 = strchr(p2, ','); p2 != NULL; i++) {
+			p2++;
 			p2 = strchr(p2, ',');
+		}
 
 		/*
 		 * We first allocate a new ident signature structure with the