Another PR20589 fix by updating user_buffer_quoted[_error]().

* tapset/uconversions.stp (user_buffer_quoted): Validate the
  'outlen' parameter, ensuring it is between 0 and MAXSTRINGLEN.
  (user_buffer_quoted_error): Ditto.
* tapset/linux/conversions.stp (kernel_buffer_quoted): Fix use of outlen.
* testsuite/buildok/conversions.stp: Move uconversion tests to
  uconversions.stp and update list of functions tested.
* testsuite/buildok/uconversions.stp: New file.

diff --git a/tapset/linux/conversions.stp b/tapset/linux/conversions.stp
index 3bd8cea8ac077736fbf85c6ea993128ad74c56a8..49d8d6b7d8ad315f0706e764f444d3b622800619 100644 (file)
--- a/tapset/linux/conversions.stp
+++ b/tapset/linux/conversions.stp
@@ -364,7 +364,7 @@ function kernel_buffer_quoted:string (addr:long, inlen:long, outlen:long)
     return;
   if ( _stp_text_str(STAP_RETVALUE, (char *)(uintptr_t)STAP_ARG_addr,
                     STAP_ARG_inlen, outlen, 1, 0, 1) < 0)
-    snprintf(STAP_RETVALUE, STAP_ARG_outlen, "0x%lx",
+    snprintf(STAP_RETVALUE, outlen, "0x%lx",
             (unsigned long)(void *)(uintptr_t)STAP_ARG_addr);
 %}
 

diff --git a/tapset/uconversions.stp b/tapset/uconversions.stp
index cad05d50b546a1bcd28ccc311084e2f1561a2ac8..3ca87299497288d8f19f8a1ae46a1d6cdc601778 100644 (file)
--- a/tapset/uconversions.stp
+++ b/tapset/uconversions.stp
@@ -1047,10 +1047,13 @@ function user_uint64:long (addr:long) {
  */
 function user_buffer_quoted:string (addr:long, inlen:long, outlen:long)
 %{
-  if ( _stp_text_str(STAP_RETVALUE,
-                       (char *)(uintptr_t)STAP_ARG_addr,
-                       STAP_ARG_inlen, STAP_ARG_outlen, 1, 1, 1) < 0)
-                       snprintf(STAP_RETVALUE, STAP_ARG_outlen, "0x%x",(unsigned int) STAP_ARG_addr);
+  size_t outlen = (size_t)clamp_t(int, STAP_ARG_outlen, 0, MAXSTRINGLEN);
+  if (outlen == 0)
+    return;
+  if ( _stp_text_str(STAP_RETVALUE, (char *)(uintptr_t)STAP_ARG_addr,
+                    STAP_ARG_inlen, outlen, 1, 1, 1) < 0)
+    snprintf(STAP_RETVALUE, outlen, "0x%lx",
+            (unsigned long)(void *)(uintptr_t)STAP_ARG_addr);
 %}
 
 /**
@@ -1069,8 +1072,11 @@ function user_buffer_quoted:string (addr:long, inlen:long, outlen:long)
  */
 function user_buffer_quoted_error:string (addr:long, inlen:long, outlen:long)
 %{
-  if (_stp_text_str(STAP_RETVALUE,
-                        (char *) (uintptr_t) STAP_ARG_addr,
-                        STAP_ARG_inlen, STAP_ARG_outlen, 1, 1, 1) < 0)
-                        STAP_ERROR("Unable to access user space data");
+  size_t outlen = (size_t)clamp_t(int, STAP_ARG_outlen, 0, MAXSTRINGLEN);
+  if (outlen == 0
+      || _stp_text_str(STAP_RETVALUE,
+                      (char *) (uintptr_t) STAP_ARG_addr,
+                      STAP_ARG_inlen, outlen, 1, 1, 1) < 0)
+    STAP_ERROR("Unable to access user space data at 0x%lx",
+              (unsigned long)(void *)(uintptr_t)STAP_ARG_addr);
 %}

diff --git a/testsuite/buildok/conversions.stp b/testsuite/buildok/conversions.stp
index e0470896fb78ae10cd5e73fa16ce97ba0e822c27..f051bff7b4ad794a693d67b77401c5d936e77875 100755 (executable)
--- a/testsuite/buildok/conversions.stp
+++ b/testsuite/buildok/conversions.stp
@@ -4,45 +4,25 @@
 
 probe begin {
   print (kernel_string(2342))
+  print (kernel_string(2342, "foobar"))
+  print (kernel_string_quoted(2342))
   print (kernel_string_n(2342, 1))
+
   print (kernel_string_utf32(2342))
-  print (kernel_string_utf16(2342))
+  print (kernel_string_utf32(2342, "foobar"))
   print (kernel_string_quoted_utf32(2342))
+
+  print (kernel_string_utf16(2342))
+  print (kernel_string_utf16(2342, "foobar"))
   print (kernel_string_quoted_utf16(2342))
+
   print (kernel_long(2342))
   print (kernel_int(2342))
   print (kernel_short(2342))
   print (kernel_char(2342))
   print (kernel_pointer(2342))
 
-  print (user_string(2342))
-  print (user_string(2342,"foobar"))
-  print (user_string_warn(2342))
-  print (user_string_quoted (2342))
-
-  print (user_string_n(2342, 5))
-  print (user_string_n(2342, 5, "foobar"))
-  print (user_string_n_warn(2342, 5))
-  print (user_string_n_quoted(2342, 5))
-  print (user_string_utf32(2342))
-  print (user_string_utf16(2342))
-  print (user_short(2342))
-  print (user_short_warn(2342))
-  print (user_int(2342))
-  print (user_int_warn(2342))
-  print (user_long(2342))
-  print (user_long_warn(2342))
-  print (user_ulong(2342))
-  print (user_ulong_warn(2342))
-  print (user_char(2342))
-  print (user_char_warn(2342))
-
-  print (user_int8(2342))
-  print (user_uint8(2342))
-  print (user_int16(2342))
-  print (user_uint16(2342))
-  print (user_int32(2342))
-  print (user_uint32(2342))
-  print (user_int64(2342))
-  print (user_uint64(2342))
+  print (kernel_buffer_quoted(2342, 10))
+  print (kernel_buffer_quoted(2342, 10, 100))
+  print (kernel_buffer_quoted_error(2342, 10, 100))
 }

diff --git a/testsuite/buildok/uconversions.stp b/testsuite/buildok/uconversions.stp
new file mode 100644 (file)
index 0000000..5c6027f
--- /dev/null
+++ b/testsuite/buildok/uconversions.stp
@@ -0,0 +1,77 @@
+#! stap -p4
+
+# Test the uconversions tapset.
+
+probe begin {
+  print (user_string(2342))
+  print (user_string(2342,"foobar"))
+  print (user_string_warn(2342))
+  print (user_string_warn(2342, "foobar"))
+  print (user_string_quoted (2342))
+
+  print (user_string_n(2342, 5))
+  print (user_string_n(2342, 5, "foobar"))
+  print (user_string_n_warn(2342, 5))
+  print (user_string_n_warn(2342, 5, "foobar"))
+  print (user_string_n_quoted(2342, 5))
+  print (user_string_n_quoted(2342, 5, 128))
+
+  print (user_string_utf32(2342))
+  print (user_string_utf32(2342, "foobar"))
+  print (user_string_quoted_utf32(2342))
+
+  print (user_string_utf16(2342))
+  print (user_string_utf16(2342, "foobar"))
+  print (user_string_quoted_utf16(2342))
+
+  print (user_char_error(2342))
+  print (user_char(2342))
+  print (user_char_warn(2342))
+
+  print (user_short_error(2342))
+  print (user_short(2342))
+  print (user_short_warn(2342))
+
+  print (user_ushort_error(2342))
+  print (user_ushort(2342))
+  print (user_ushort_warn(2342))
+
+  print (user_int_error(2342))
+  print (user_int(2342))
+  print (user_int_warn(2342))
+
+  print (user_long_error(2342))
+  print (user_long(2342))
+  print (user_long_warn(2342))
+
+  print (user_ulong_error(2342))
+  print (user_ulong(2342))
+  print (user_ulong_warn(2342))
+
+  print (user_int8_error(2342))
+  print (user_int8(2342))
+
+  print (user_uint8_error(2342))
+  print (user_uint8(2342))
+
+  print (user_int16_error(2342))
+  print (user_int16(2342))
+
+  print (user_uint16_error(2342))
+  print (user_uint16(2342))
+
+  print (user_int32_error(2342))
+  print (user_int32(2342))
+
+  print (user_uint32_error(2342))
+  print (user_uint32(2342))
+
+  print (user_int64_error(2342))
+  print (user_int64(2342))
+
+  print (user_uint64_error(2342))
+  print (user_uint64(2342))
+
+  print (user_buffer_quoted(2342, 10, 128))
+  print (user_buffer_quoted_error(2342, 10, 128))
+}