diff options
| author | Ross Zwisler <ross.zwisler@linux.intel.com> | 2017-12-07 14:35:02 -0700 |
|---|---|---|
| committer | Eryu Guan <eguan@redhat.com> | 2017-12-10 17:46:05 +0800 |
| commit | ce00907d09db3147423485e60db217a3335dfbd8 (patch) | |
| tree | 7a6f674a2ee0c902f8996a907a14a0fd771b4911 | |
| parent | 8b71ca416246277481aee2dd74684797dd01101f (diff) | |
| download | xfstests-ce00907d09db3147423485e60db217a3335dfbd8.tar.gz | |
build: fix TagName overflow issues
The 'TagName' string is defined to be 40 characters in length, but
in three places we write into it with a format of "(%.39s)". This
can result in a string of up to 42 characters, the 39 character user
string plus "()\0". This overflows TagName, as we see in the new
complier warnings from gcc 7.2.1:
iogen.c:1277:6: note: 'sprintf' output between 3 and 42 bytes into a
destination of size 40
sprintf( TagName, "(%.39s)", optarg );
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fix this by limiting the user string to 37 characters.
Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
| -rw-r--r-- | ltp/doio.c | 2 | ||||
| -rw-r--r-- | ltp/growfiles.c | 2 | ||||
| -rw-r--r-- | ltp/iogen.c | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/ltp/doio.c b/ltp/doio.c index dcb3efd8c8..b937718756 100644 --- a/ltp/doio.c +++ b/ltp/doio.c @@ -3184,7 +3184,7 @@ char *opts; break; case 'N': - sprintf( TagName, "(%.39s)", optarg ); + sprintf( TagName, "(%.37s)", optarg ); break; case 'n': diff --git a/ltp/growfiles.c b/ltp/growfiles.c index fb91761f56..ad1ecdf5df 100644 --- a/ltp/growfiles.c +++ b/ltp/growfiles.c @@ -794,7 +794,7 @@ extern int Forker_npids; /* num of forked pid, defined in forker.c */ break; case 'W': - sprintf( TagName, "(%.39s)", optarg ); + sprintf( TagName, "(%.37s)", optarg ); break; case 'y': diff --git a/ltp/iogen.c b/ltp/iogen.c index 1eaab1f0cf..8fc339e54c 100644 --- a/ltp/iogen.c +++ b/ltp/iogen.c @@ -1274,7 +1274,7 @@ char *opts; break; case 'N': - sprintf( TagName, "(%.39s)", optarg ); + sprintf( TagName, "(%.37s)", optarg ); break; case 'o': |