Unverified Commit f4b00a3e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9820 kdb: Fix buffer overflow during tab-complete 

Merge Pull Request from: @ci-robot 
 
PR sync from: Tengda Wu <wutengda2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/7ZXU74VKIDCIL4YGQKOHRQGF7JI7GUE7/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAB05N 
 
Link:https://gitee.com/openeuler/kernel/pulls/9820

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents dbbaf94c 6a2af802

kernel/debug/kdb/kdb_io.c

+13 −8
Original line number Diff line number Diff line
@@ -354,14 +354,19 @@ static char *kdb_read(char *buffer, size_t bufsize) 
			kdb_printf(kdb_prompt_str);

			kdb_printf("%s", buffer);

		} else if (tab != 2 && count > 0) {

			len_tmp = strlen(p_tmp);

			strncpy(p_tmp+len_tmp, cp, lastchar-cp+1);

			len_tmp = strlen(p_tmp);

			strncpy(cp, p_tmp+len, len_tmp-len + 1);

			len = len_tmp - len;

			/* How many new characters do we want from tmpbuffer? */

			len_tmp = strlen(p_tmp) - len;

			if (lastchar + len_tmp >= bufend)

				len_tmp = bufend - lastchar;



			if (len_tmp) {

				/* + 1 ensures the '\0' is memmove'd */

				memmove(cp+len_tmp, cp, (lastchar-cp) + 1);

				memcpy(cp, p_tmp+len, len_tmp);

				kdb_printf("%s", cp);

			cp += len;

			lastchar += len;

				cp += len_tmp;

				lastchar += len_tmp;

			}

		}

		kdb_nextline = 1; /* reset output line number */

		break;