lkml.org 
[lkml]   [2017]   [Jul]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 21/22] fscache: fix fscache_objlist_show format processing
    Date
    gcc points out a minor bug in the handling of unknown
    cookie types, which could result in a string overflow
    when the integer is copied into a 3-byte string:

    fs/fscache/object-list.c: In function 'fscache_objlist_show':
    fs/fscache/object-list.c:265:19: error: 'sprintf' may write a terminating nul past the end of the destination [-Werror=format-overflow=]
    sprintf(_type, "%02u", cookie->def->type);
    ^~~~~~
    fs/fscache/object-list.c:265:4: note: 'sprintf' output between 3 and 4 bytes into a destination of size 3

    This is currently harmless as no code sets a type other
    than 0 or 1, but it makes sense to use snprintf() here
    to avoid overflowing the array if that changes.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    ---
    fs/fscache/object-list.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
    index 67f940892ef8..b5ab06fabc60 100644
    --- a/fs/fscache/object-list.c
    +++ b/fs/fscache/object-list.c
    @@ -262,7 +262,8 @@ static int fscache_objlist_show(struct seq_file *m, void *v)
    type = "DT";
    break;
    default:
    - sprintf(_type, "%02u", cookie->def->type);
    + snprintf(_type, sizeof(_type), "%02u",
    + cookie->def->type);
    type = _type;
    break;
    }
    --
    2.9.0
    \
     
     \ /
      Last update: 2017-07-14 14:16    [W:4.222 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site