Skip to content

Commit

Permalink
Check that the read attr struct size is at most equal to the declared…
Browse files Browse the repository at this point in the history
… size of the event payload.

Any remaining bytes are event IDs. But if the declared payload size is smaller,
subtracting these unsigned values when computing the number of IDs yields a very
large number, which subsequently leads to a memory allocation failure.

PiperOrigin-RevId: 688313672
  • Loading branch information
gmarin13 authored and shantuo committed Dec 9, 2024
1 parent 6395752 commit 3a715e1
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions src/quipper/perf_reader.cc
Original file line number Diff line number Diff line change
Expand Up @@ -2360,6 +2360,12 @@ bool PerfReader::ReadAttrEventBlock(DataReader* data, size_t size) {

// attr.attr.size has been upgraded to the current size of perf_event_attr.
const size_t actual_attr_size = data->Tell() - initial_offset;
if (size < actual_attr_size) {
LOG(ERROR) << "Declared payload size " << size << " of "
<< "PERF_RECORD_HEADER_ATTR event is less than the number of "
<< "bytes read for the attr_event struct " << actual_attr_size;
return false;
}

const size_t num_ids =
(size - actual_attr_size) / sizeof(decltype(attr.ids)::value_type);
Expand Down

0 comments on commit 3a715e1

Please sign in to comment.