On Wed, Aug 01, 2012 at 08:26:11AM -0600, David Ahern wrote:
> On 8/1/12 4:11 AM, Jiri Olsa wrote:
> >+static int
> >+parse_callchain_opt(const struct option *opt __used, const char *arg,
> >+                int unset)
> >+{
> >+    struct perf_record *rec = (struct perf_record *)opt->value;
> >+    char *tok, *name, *saveptr = NULL;
> >+    char buf[20];
> >+    int ret = -1;
> >+
> >+    /* --no-call-graph */
> >+    if (unset)
> >+            return 0;
> >+
> >+    /* We specified default option if none is provided. */
> >+    BUG_ON(!arg);
> >+
> >+    /* We need buffer that we know we can write to. */
> >+    snprintf(buf, 20, "%s", arg);
> 
> Isn't arg the user supplied string? What if the user messes up and
> passes in 20+ characters to -g argument?

  [jolsa@dhcp-26-214 perf]$ ./perf record -g 
dwarf123213214321432143214321432143214321432143214321 ls
  callchain: Unknown -g option value: dwarf12321321432143
  ...

hm, but if user specified it like this:

  [jolsa@dhcp-26-214 perf]$ ./perf record -vg 'dwarf,                    50000' 
ls
  callchain: Incorrect stack dump size (max 65528):              

then we're in trouble.. I'll send a fix

thanks,
jirka
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to