All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stephen Hemminger <stephen@networkplumber.org>
To: netdev@vger.kernel.org
Cc: Stephen Hemminger <stephen@networkplumber.org>
Subject: [PATCH iproute 1/3] lib: don't build printf formats out of names
Date: Mon, 19 Oct 2026 13:03:02 -0700	[thread overview]
Message-ID: <20261019200623.816470-2-stephen@networkplumber.org> (raw)
In-Reply-To: <20261019200623.816470-1-stephen@networkplumber.org>

print_string_name_value() and print_uint_name_value() snprintf'd the
caller's name into a 64-byte buffer and used it as the printf format, so
a '%' in the name was taken as a conversion and names over 63 bytes lost
their value to truncation. Pass the name as a string argument with a
literal format instead.

Fixes: 31ca29b2bec4 ("json_print: Introduce print_#type_name_value")
Reported-by: Anthropic OSS scanner
Assiste-By: Claude:claude-opus-5-5
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 lib/json_print.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/lib/json_print.c b/lib/json_print.c
index f604f265..e028e766 100644
--- a/lib/json_print.c
+++ b/lib/json_print.c
@@ -147,11 +147,8 @@ _PRINT_FUNC(float, double);
 #define _PRINT_NAME_VALUE_FUNC(type_name, type, format_char)		 \
 	void print_##type_name##_name_value(const char *name, type value)\
 	{								 \
-		SPRINT_BUF(format);					 \
-									 \
-		snprintf(format, SPRINT_BSIZE,				 \
-			 "%s %%"#format_char, name);			 \
-		print_##type_name(PRINT_ANY, name, format, value);	 \
+		print_string(PRINT_FP, NULL, "%s ", name);		 \
+		print_##type_name(PRINT_ANY, name, "%"#format_char, value); \
 	}
 _PRINT_NAME_VALUE_FUNC(uint, unsigned int, u);
 _PRINT_NAME_VALUE_FUNC(string, const char*, s);
-- 
2.53.0


  reply	other threads:[~2026-10-19 20:06 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-19 20:03 [PATCH iproute2 0/3] don't build printf formats out of names Stephen Hemminger
2026-10-19 20:03 ` Stephen Hemminger [this message]
2026-10-19 20:03 ` [PATCH iproute 2/3] rdma: don't build printf formats out of keys Stephen Hemminger
2026-10-20 13:10   ` Leon Romanovsky
2026-10-19 20:03 ` [PATCH iproute 3/3] vdpa: don't build printf format out of vendor stats name Stephen Hemminger

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261019200623.816470-2-stephen@networkplumber.org \
    --to=stephen@networkplumber.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.