From: Dongwoo Lee <dwoo08.lee@samsung.com>
Date: Thu, 25 Aug 2022 05:11:42 +0000 (+0900)
Subject: util: kernel: Get the name of smaps entry with limited width
X-Git-Tag: submit/tizen/20220830.081307~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F30%2F280230%2F2;p=platform%2Fcore%2Fsystem%2Fpass.git

util: kernel: Get the name of smaps entry with limited width

Since sscanf has no limitation for buffer width and thus it can cause
overflows for name buffer, this limits the number of reading
characters.

Change-Id: I83128e01d9b840d41bb14bfda022e27ee80dd78e
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
---

diff --git a/src/util/kernel.c b/src/util/kernel.c
index 2171e01..996c83d 100644
--- a/src/util/kernel.c
+++ b/src/util/kernel.c
@@ -439,28 +439,29 @@ static inline bool is_new_entry(const char *str)
 	return ((*str >= '0' && *str <= '9') || (*str >= 'a' && *str <= 'f'));
 }
 
-static unsigned long get_gpu_mem_size(FILE *smaps_fd, char *entry)
+#define LEN_FORMAT(S) "%" #S "[^\n]"
+#define STR_LEN_FORMAT(S) LEN_FORMAT(S)
+
+static unsigned long get_gpu_mem_size(FILE *smaps_fd, char *buffer)
 {
 	unsigned long mem_size = 0;
 	char name[BUFF_MAX];
-	char buffer[BUFF_MAX];
 
 	if (!gpu_mem_node)
 		return 0;
 
 new_entry:
-	sscanf(entry, "%*s %*s %*s %*s %*s %[^\n]", name);
+	/* parsing name from entry line */
+	sscanf(buffer, "%*s %*s %*s %*s %*s" STR_LEN_FORMAT(BUFF_MAX), name);
 
-	if (strstr(name, gpu_mem_node->path)) {
-		while (fgets(buffer, sizeof(buffer), smaps_fd)) {
-			if (strstr(buffer, gpu_mem_node->node))
-				mem_size += strtol(buffer + strlen(gpu_mem_node->node), NULL, 10);
+	if (!strstr(name, gpu_mem_node->path))
+		return mem_size;
 
-			if (is_new_entry(buffer)) {
-				entry = buffer;
-				goto new_entry;
-			}
-		}
+	while (fgets(buffer, BUFF_MAX, smaps_fd)) {
+		if (strstr(buffer, gpu_mem_node->node))
+			mem_size += strtol(buffer + strlen(gpu_mem_node->node), NULL, 10);
+		else if (is_new_entry(buffer))
+			goto new_entry;
 	}
 
 	return mem_size;
@@ -487,8 +488,10 @@ int kernel_get_thread_group_map_info(struct proc_map_info *map_info,
 	memset(map_info, 0, sizeof(struct proc_map_info));
 
 	while (fgets(buffer, sizeof(buffer), smaps_fd)) {
-		if (include_gpu_mem && is_new_entry(buffer))
+		if (include_gpu_mem && is_new_entry(buffer)) {
 			map_info->gpu_mem += get_gpu_mem_size(smaps_fd, buffer);
+			continue;
+		}
 
 		if (strstart(buffer, "Rss:"))
 			map_info->rss += strtol(buffer + 4, NULL, 10);