Fix write behind allocated memory in thread name setting (#34424)
authorJan Vorlicek <janvorli@microsoft.com>
Thu, 2 Apr 2020 00:57:02 +0000 (02:57 +0200)
committerGitHub <noreply@github.com>
Thu, 2 Apr 2020 00:57:02 +0000 (02:57 +0200)
The code in CorUnix::InternalSetThreadDescription is writing behind
the end of the allocated memory in case the name is shorter than 16
characters. That is causing memory heap corruption.

src/coreclr/src/pal/src/thread/thread.cpp

index 1473601..159ef03 100644 (file)
@@ -1666,7 +1666,10 @@ CorUnix::InternalSetThreadDescription(
 
     // Null terminate early.
     // pthread_setname_np only accepts up to 16 chars.
-    nameBuf[15] = '\0';
+    if (nameSize > 15)
+    {
+        nameBuf[15] = '\0';
+    }
 
     error = pthread_setname_np(pTargetThread->GetPThreadSelf(), nameBuf);