perf tools: Do not accept parse_tag_value() overflow

parse_tag_value() accepts an "unsigned long" and multiplies it according
to a tag character.  Do not accept the value if the multiplication
overflows.

Signed-off-by: Adrian Hunter <[email protected]>
Cc: David Ahern <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Mike Galbraith <[email protected]>
Cc: Namhyung Kim <[email protected]>
Cc: Paul Mackerras <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Stephane Eranian <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index c25e57b3acb2994d7d53b8089f1897030b71efb7..28a0a89c1f739749a59c8b80aa3d3b37d8f4000f 100644 (file)
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -386,6 +386,8 @@ unsigned long parse_tag_value(const char *str, struct parse_tag *tags)
                        if (s != endptr)
                                break;
 
+                       if (value > ULONG_MAX / i->mult)
+                               break;
                        value *= i->mult;
                        return value;
                }