| Message ID | 20241119151809.4da5f874@gandalf.local.home (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 45a9b0647c904b7bf1240da5a11fe3a1ffd1006d |
| Headers | show |
| Series | libtraceevent: Handle case of unknown operator | expand |
Hello Steve, On 19/11/2024 21:18, Steven Rostedt wrote: > From: "Steven Rostedt (Google)" <rostedt@goodmis.org> > > The m68k architecture had a trace event with "m68k_memory[0].addr >> 13" > in it. The parsing after the ']' and before the '.' checked the priority > of the '.' but because it does not handle '.' as an operator it returned a > negative number. But process_op() did not check for an error and continued > processing. This caused a segfault. > > Return immediately if the operator is not handled by get_op_prio(). > > Link: https://lore.kernel.org/all/20241119112850.219834f5@gandalf.local.home/ > > Reported-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org> > Fixes: 6582b0aea1cc ("tools/events: Add files to create libtraceevent.a") > Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Thank you for your patch ! Tested-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org> > --- > src/event-parse.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/src/event-parse.c b/src/event-parse.c > index 0427061603db..a6da8f04cbf3 100644 > --- a/src/event-parse.c > +++ b/src/event-parse.c > @@ -2498,6 +2498,10 @@ process_op(struct tep_event *event, struct tep_print_arg *arg, char **tok) > > /* higher prios need to be closer to the root */ > prio = get_op_prio(*tok); > + if (prio < 0) { > + token = *tok; > + goto out_free; > + } > > if (prio > arg->op.prio) > return process_op(event, arg, tok);
diff --git a/src/event-parse.c b/src/event-parse.c index 0427061603db..a6da8f04cbf3 100644 --- a/src/event-parse.c +++ b/src/event-parse.c @@ -2498,6 +2498,10 @@ process_op(struct tep_event *event, struct tep_print_arg *arg, char **tok) /* higher prios need to be closer to the root */ prio = get_op_prio(*tok); + if (prio < 0) { + token = *tok; + goto out_free; + } if (prio > arg->op.prio) return process_op(event, arg, tok);