Commit 110a6617 authored by Arnaldo Carvalho de Melo's avatar Arnaldo Carvalho de Melo Committed by Namhyung Kim
Browse files

perf header: Sanity check HEADER_CACHE 



Add upper bound check on cache entry count in process_cache() to harden
against malformed perf.data files (max 32768).

Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude Code:claude-opus-4-6
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: default avatarNamhyung Kim <namhyung@kernel.org>
parent 6830e20c

tools/perf/util/header.c

+13 −0
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ 
#include <event-parse.h>

#endif



#define MAX_CACHE_ENTRIES	32768

#define MAX_GROUP_DESC		32768

#define MAX_NUMA_NODES		4096

#define MAX_PMU_MAPPINGS	4096
@@ -3243,6 +3244,18 @@ static int process_cache(struct feat_fd *ff, void *data __maybe_unused) 
	if (do_read_u32(ff, &cnt))

		return -1;



	if (cnt > MAX_CACHE_ENTRIES) {

		pr_err("Invalid HEADER_CACHE: cnt (%u) > %u\n",

		       cnt, MAX_CACHE_ENTRIES);

		return -1;

	}



	if (ff->size < 2 * sizeof(u32) + cnt * 7 * sizeof(u32)) {

		pr_err("Invalid HEADER_CACHE: section too small (%zu) for %u entries\n",

		       ff->size, cnt);

		return -1;

	}



	caches = calloc(cnt, sizeof(*caches));

	if (!caches)

		return -1;