From ffee26c3703dd76bca7a8d445445f4259856140a Mon Sep 17 00:00:00 2001 From: Jim Warner Date: Sat, 2 Jun 2018 00:00:00 -0500 Subject: [PATCH] top: check sortindx risk exposure (not treat symptoms) Rather than validate the window's 'sortindx' each time it was referenced (as was done in the patch below), we now ensure the validity just once when the config file is read. Thereafter, a running top will police bounds. Reference(s): . original qualys patch 0102-top-Check-sortindx.patch Signed-off-by: Jim Warner --- top/top.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/top/top.c b/top/top.c index d51d5aa5..d05fb34e 100644 --- a/top/top.c +++ b/top/top.c @@ -3213,6 +3213,8 @@ static int config_cvt (WIN_t *q) { // lastly, we must adjust the old sort field enum... x = q->rc.sortindx; q->rc.sortindx = fields_src[x] - FLD_OFFSET; + if (q->rc.sortindx < 0 || q->rc.sortindx >= EU_MAXPFLGS) + return 1; return 0; } // end: config_cvt @@ -3260,6 +3262,8 @@ error Hey, fix the above fscanf 'PFLAGSSIZ' dependency ! if (3 > fscanf(fp, "\twinflags=%d, sortindx=%d, maxtasks=%d, graph_cpus=%d, graph_mems=%d\n" , &w->rc.winflags, &w->rc.sortindx, &w->rc.maxtasks, &w->rc.graph_cpus, &w->rc.graph_mems)) return p; + if (w->rc.sortindx < 0 || w->rc.sortindx >= EU_MAXPFLGS) + return p; if (w->rc.graph_cpus < 0 || w->rc.graph_cpus > 2) return p; if (w->rc.graph_mems < 0 || w->rc.graph_mems > 2)