[PATCH iproute2 0/3] don't build printf formats out of names

[Stephen Hemminger <stephen@networkplumber.org>]

Several print helpers built a printf format string by concatenating a
name or key onto a conversion specifier, then passed the result to
printf as the format. This is unsafe since '%' in name would
be converted by printf.

Most of the affected names are string literals, but the rdma driver
attribute and hwcounter keys and the vdpa vendor statistics names come
from the kernel, so they are not under iproute2's control. No failures
have been reported in practice. Each patch passes the name as a normal
string argument with a literal format instead; text and JSON output are
otherwise unchanged.

Found by an automated source scan (ANT-2026-JAWA8082).

Stephen Hemminger (3):
  lib: don't build printf formats out of names
  rdma: don't build printf formats out of keys
  vdpa: don't build printf format out of vendor stats name

 lib/json_print.c |  7 ++-----
 rdma/res-cmid.c  |  3 ++-
 rdma/res.c       | 10 +++++-----
 rdma/utils.c     |  4 ++--
 vdpa/vdpa.c      | 14 +++-----------
 5 files changed, 14 insertions(+), 24 deletions(-)

-- 
2.53.0