[PATCH 3/3] stapbpf: check runtime allocations

[m.dmitrichenko222@gmail.com]

From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>

stapbpf assumes that allocations for module names and the perf event
poll array always succeed. A failed allocation is followed by a write
through the NULL pointer.

Report the allocation failure and terminate through fatal() instead.
Keep a zero-length poll array valid because malloc(0) is permitted to
return NULL.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
---
 stapbpf/stapbpf.cxx | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/stapbpf/stapbpf.cxx b/stapbpf/stapbpf.cxx
index ed6d67da4..2eea57598 100644
--- a/stapbpf/stapbpf.cxx
+++ b/stapbpf/stapbpf.cxx
@@ -1600,6 +1600,8 @@ load_bpf_file(const char *module)
 
   /* Extract basename: */
   char *buf = (char *)malloc(BPF_MAXSTRINGLEN * sizeof(char));
+  if (!buf)
+    fatal("Out of memory allocating module basename\n");
   // NB: If module doesn't contain a single '/', then the behaviour
   // of rfind (-1) and substr (-1 + 1) will default to module_str.
   string module_basename_str
@@ -1610,6 +1612,8 @@ load_bpf_file(const char *module)
 
   /* Extract name: */
   buf = (char*) malloc(BPF_MAXSTRINGLEN * sizeof(char));
+  if (!buf)
+    fatal("Out of memory allocating module name\n");
   string suffix = ".bo";
   string module_name_str
     = module_basename_str.substr(0, module_basename_str.rfind(suffix)); // name
@@ -2034,6 +2038,8 @@ perf_event_loop(pthread_t main_thread)
     fatal("Too many active CPUs for pollfd allocation\n");
   struct pollfd *pmu_fds
     = (struct pollfd *)malloc(n_active_cpus * sizeof(struct pollfd));
+  if (n_active_cpus && !pmu_fds)
+    fatal("Out of memory allocating pollfd array\n");
   vector<unsigned> cpuids;
 
   assert(ncpus == perf_fds.size());
-- 
2.25.1