procio: fix potential out-of-bounds access when write fails

When writing to procfs via `proc_write` fails, we try to chunk the
buffer into smaller pieces to work around that issue. When searching for
the next location to split the buffer, though, we can underflow the
buffer in case the current offset is smaller than `LINELEN`. Fix the
issue by passing `cookie->offset` instead of `LINELEN` into `memrchr` in
case `cookie->offset` is smaller than `LINELEN`.

This bug can be triggered on musl-based systems, e.g. by executing

    $ sysctl kernel.printk_ratelimit=1000000000000000

As the value is out-of-range, `write` will return an error and set
`errno` to `EINVAL`. As we're only trying to write a smallish buffer
with a length smaller than `LINELEN` and as the buffer does not contain
any newlines, the call

    token = (char*)memrchr(cookie->buf+offset, '\n', LINELEN);

will underflow the buffer and crash the program.

Signed-off-by: Patrick Steinhardt <ps@pks.im>

diff --git a/lib/procio.c b/lib/procio.c
index 5cc7af66f4f0a94241dafafde1cfa07fa5312743..bbd7c84b90a3e9288e8237c767c05ac6136e0604 100644 (file)
--- a/lib/procio.c
+++ b/lib/procio.c
@@ -251,7 +251,7 @@ ssize_t proc_write(void *c, const char *buf, size_t count)
                                if (cookie->offset > LINELEN)
                                        token = (char*)memrchr(cookie->buf+offset, cookie->delim, LINELEN);
                                else
-                                       token = (char*)memrchr(cookie->buf+offset, '\n', LINELEN);
+                                       token = (char*)memrchr(cookie->buf+offset, '\n', cookie->offset);
                                if (token)
                                        *token = '\n';
                                else {