Re: [RFC PATCH v4 1/6] perf stat: Parse and find tpebs events when parsing metrics to prepare for perf record sampling

[Andi Kleen]

weilin.wang@xxxxxxxxx writes:
> +
> +			new_event->tpebs_name = strdup(id);
> +			*p = '\0';
> +			name = malloc(strlen(id) + 2);
> +			if (!name)
> +				return -ENOMEM;
> +
> +			at = strchr(id, '@');
> +			if (at != NULL) {
> +				*at = '/';
> +				at = strchr(id, '@');
> +				*at = '/';
> +				strcpy(name, id);
> +				strcat(name, "p");
> +			} else {
> +				strcpy(name, id);
> +				strcat(name, ":p");


This seems like a buffer overflow because :p is 3 bytes including 0,
but you only allocate + 2.
You should really use safe string primitives, then you would have
noticed the truncation.

-Andi