[DragonFlyBSD - Bug #3424] (New) libevtr: off-by-one in string namespace indexing

[sigttou]

Issue #3424 has been reported by sigttou.

----------------------------------------
Bug #3424: libevtr: off-by-one in string namespace indexing
http://bugs.dragonflybsd.org/issues/3424

* Author: sigttou
* Status: New
* Priority: Normal
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-26
----------------------------------------
evtr_dump_string() does strings[ns], but the array is strings[EVTR_NS_MAX - 1]
(3 entries, indices 0..2). Namespace IDs run 1..3, so ns == 3
(EVTR_NS_DSTR) is out of bounds.

strings[3] aliases the next union member, fmts. Dynamic strings and format
strings then share one hash table, and evtr_open_write() overwrites the first
fmts allocation and leaks it.

The read side uses maps[ns - 1]. Make the write side match: strings[ns - 1],
and allocate/free EVTR_NS_MAX - 1 entries.

Also reject ns == 0 in evtr_load_string(); it passes the check, then does
maps[ns - 1], i.e. maps[-1].

Reached via "ktrdump -d".

Attached: 0001-libevtr-Fix-off-by-one-in-string-namespace-indexing.patch

---Files--------------------------------
0001-libevtr-Fix-off-by-one-in-string-namespace-indexing.patch (2.12 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account