Skip to content

util: Fix buffer overflow in process_field_size_default#3370

Open
jimmunn wants to merge 1 commit into
linux-nvme:masterfrom
Micron-TPG-OSS:fix/field-parser-buffer-overflow
Open

util: Fix buffer overflow in process_field_size_default#3370
jimmunn wants to merge 1 commit into
linux-nvme:masterfrom
Micron-TPG-OSS:fix/field-parser-buffer-overflow

Conversation

@jimmunn
Copy link
Copy Markdown
Contributor

@jimmunn jimmunn commented May 18, 2026

The process_field_size_default function used a fixed 256-byte buffer for formatting hex output, which overflowed when processing fields larger than 127 bytes (such as Reserved fields up to 302 bytes in Micron SMART logs). This caused segmentation faults.

Additionally, the loop counter was an unsigned char, limiting processing to 255 bytes maximum.

Fix by:

  • Converting all process_field_size_* functions to return dynamically allocated strings instead of writing to caller-provided buffers
  • Using asprintf() for consistent dynamic allocation
  • Using __cleanup_free in the caller for automatic memory management
  • Also fixes a pre-existing memory leak where hex_to_ascii() return value was never freed

The process_field_size_default function used a fixed 256-byte buffer
for formatting hex output, which overflowed when processing fields
larger than 127 bytes (such as Reserved fields up to 302 bytes in
Micron SMART logs). This caused segmentation faults.

Additionally, the loop counter was an unsigned char, limiting
processing to 255 bytes maximum.

Fix by:
- Converting all process_field_size_* functions to return dynamically
  allocated strings instead of writing to caller-provided buffers
- Using asprintf() for consistent dynamic allocation
- Using __cleanup_free in the caller for automatic memory management
- Also fixes a pre-existing memory leak where hex_to_ascii() return
  value was never freed

Signed-off-by: Jim Munn <jlmunn@micron.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant