[PATCH 1/3] tools/mm: terminate the record buffer before matching the timestamp

[2-D Godoy]

add_list() copies the record into a heap buffer of len + 1 bytes and then
calls remove_pattern() on that copy, which runs regexec() over it.  The
terminator is only written after the pattern is removed, so regexec()
walks past the end of the allocation whenever the byte just past the copy
is not zero.

Sorting any page_owner dump is enough to hit it:

  =================================================================
  ERROR: AddressSanitizer: heap-buffer-overflow
  READ of size 163 at 0x60f0000002c2 thread T0
      #0 __interceptor_regexec
      #1 remove_pattern tools/mm/page_owner_sort.c:248
      #2 add_list tools/mm/page_owner_sort.c:593

Terminate the copy right after memcpy() and keep the terminator after the
pattern was removed.

Signed-off-by: Henrique Godoy <henrique.godoy@xxxxxxxxxxxx>
---
 tools/mm/page_owner_sort.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/mm/page_owner_sort.c b/tools/mm/page_owner_sort.c
index 6c2ac5d..58d4a54 100644
--- a/tools/mm/page_owner_sort.c
+++ b/tools/mm/page_owner_sort.c
@@ -589,6 +589,7 @@ static bool add_list(char *buf, int len, char *ext_buf)
 		return false;
 	}
 	memcpy(list[list_size].txt, buf, len);
+	list[list_size].txt[len] = 0;
 	if (sc.cmps[0] != compare_ts) {
 		len = remove_pattern(&ts_nsec_pattern, list[list_size].txt, len);
 	}
-- 
2.39.5