[Tarantool-patches] [PATCH] backtrace: fix out of bounds access on backtrace printing

[Vladislav Shpilevoy]

Hi! Thanks for the fix! LGTM.

On 26/11/2019 13:09, Serge Petrenko wrote:
> Hi! Thank you for review!
> 
>> 26 нояб. 2019 г., в 2:02, Vladislav Shpilevoy <v.shpilevoy at tarantool.org> написал(а):
>>
>> Hi! Thanks for the patch!
>>
>> Perhaps the zero termination was done for a case,
>> when the cycle in backtrace() does not run even one
>> iteration. For example, if unw_step() returns an
>> error. Then the buffer is not terminated. So I think
>> it is better to keep *p = 0, but do it before the
>> cycle.
> 
> True, here’s the new patch:
> 
> snrpintf always null-terminates the passed string, and it also returns
> the number of bytes that "would have been written if there was enough
> space", so not only we don't have to null-terminate the string, but even
> more so we shouldn't do it erroneously. The only case when a string
> should be null-terminated manually is when the print cycle doesn't run
> at all, so move the termination before the cycle.
> 
> Closes #4636
> ---
>  src/lib/core/backtrace.cc | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/lib/core/backtrace.cc b/src/lib/core/backtrace.cc
> index 57e541c25..77f77b05c 100644
> --- a/src/lib/core/backtrace.cc
> +++ b/src/lib/core/backtrace.cc
> @@ -143,6 +143,7 @@ backtrace()
>  	char *p = backtrace_buf;
>  	char *end = p + sizeof(backtrace_buf) - 1;
>  	int unw_status;
> +	*p = '\0';
>  	while ((unw_status = unw_step(&unw_cur)) > 0) {
>  		const char *proc;
>  		old_sp = sp;
> @@ -173,7 +174,6 @@ backtrace()
>  		say_debug("unwinding error: %i", unw_status);
>  #endif
>  out:
> -	*p = '\0';
>  	return backtrace_buf;
>  }
>  
>