[CRIU] [PATCH 0/3] IPC: Fix potential buffer overflow and zeroify	heap data
    Cyrill Gorcunov 
    gorcunov at openvz.org
       
    Tue Sep  3 17:37:29 EDT 2013
    
    
  
We write IPC data by aligned chunks, so zeroify xmalloc'ed tails.
In ipc_sem_handler allocate enough space to read image data,
otherwise we can overwrite some heap data which doesn't belong
to us (hardly to happen on libc, since it allocates heap data
by chunks internally, but anyway).
Cyrill Gorcunov (3):
  ipc: Don't access data out of allocated slab
  ipc: Zeroify data tail in dump_ipc_msg_queue_messages
  ipc: Zeroify data tail in dump_ipc_sem_set
 ipc_ns.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)
-- 
1.8.1.4
    
    
More information about the CRIU
mailing list