From: Tomas Dzik via ltp <ltp@lists.linux.it>
To: ltp@lists.linux.it
Subject: [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests
Date: Wed, 15 Jul 2026 15:04:48 +0200 [thread overview]
Message-ID: <9c830e6d52fc6f88fddd98a3b26db614ae8ef8fb.1784119861.git.tdzik@redhat.com> (raw)
In-Reply-To: <cover.1784119861.git.tdzik@redhat.com>
There are tests in testcases/misc/math/float/ which use sprintf().
It is safer to use snprintf().
Signed-off-by: Tomas Dzik <tdzik@redhat.com>
---
testcases/misc/math/float/bessel/genbessel.c | 10 +++----
.../misc/math/float/exp_log/genexp_log.c | 21 ++++++++++-----
testcases/misc/math/float/iperb/geniperb.c | 9 ++++---
testcases/misc/math/float/main.c | 18 +++++++++----
testcases/misc/math/float/power/genpower.c | 18 ++++++++-----
testcases/misc/math/float/thread_code.c | 26 ++++++++++++-------
testcases/misc/math/float/trigo/gentrigo.c | 21 ++++++++++-----
7 files changed, 81 insertions(+), 42 deletions(-)
diff --git a/testcases/misc/math/float/bessel/genbessel.c b/testcases/misc/math/float/bessel/genbessel.c
index 91ea3b6da..644aa7e3d 100644
--- a/testcases/misc/math/float/bessel/genbessel.c
+++ b/testcases/misc/math/float/bessel/genbessel.c
@@ -79,23 +79,23 @@ int main(int argc, char *argv[])
funct = malloc(strlen(bin_path) + MAX_FNAME_LEN);
if (funct == NULL)
err(1, "malloc failed");
- sprintf(funct, "%s/genj0", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genj0", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genj1", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genj1", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/geny0", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/geny0", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/geny1", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/geny1", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genlgamma", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genlgamma", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
diff --git a/testcases/misc/math/float/exp_log/genexp_log.c b/testcases/misc/math/float/exp_log/genexp_log.c
index e02d0d344..0411aa8bf 100644
--- a/testcases/misc/math/float/exp_log/genexp_log.c
+++ b/testcases/misc/math/float/exp_log/genexp_log.c
@@ -79,31 +79,38 @@ int main(int argc, char *argv[])
funct = malloc(strlen(bin_path) + MAX_FNAME_LEN);
if (funct == NULL)
err(1, "malloc failed");
- sprintf(funct, "%s/genexp", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genexp", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genlog", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genlog", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genlog10", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genlog10", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genfrexp", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genfrexp", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genldexp", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genldexp", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genhypot", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genhypot", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genmodf", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genmodf", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
diff --git a/testcases/misc/math/float/iperb/geniperb.c b/testcases/misc/math/float/iperb/geniperb.c
index 98a6a380a..2583f9cfb 100644
--- a/testcases/misc/math/float/iperb/geniperb.c
+++ b/testcases/misc/math/float/iperb/geniperb.c
@@ -80,15 +80,18 @@ int main(int argc, char *argv[])
funct = malloc(strlen(bin_path) + MAX_FNAME_LEN);
if (funct == NULL)
err(1, "malloc failed");
- sprintf(funct, "%s/gencosh", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/gencosh", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/gensinh", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/gensinh", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/gentanh", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/gentanh", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
diff --git a/testcases/misc/math/float/main.c b/testcases/misc/math/float/main.c
index 7285141a4..862250d7f 100644
--- a/testcases/misc/math/float/main.c
+++ b/testcases/misc/math/float/main.c
@@ -83,11 +83,15 @@ int generate(char *datadir, char *bin_path)
{
char *cmdline;
char *fmt = "cd %s; %s/%s %s";
+ size_t cmdline_size;
- cmdline = malloc(2 * strlen(bin_path) + strlen(datadir) + strlen(GENERATOR) + strlen(fmt));
+ cmdline_size = 2 * strlen(bin_path) + strlen(datadir);
+ cmdline_size += strlen(GENERATOR) + strlen(fmt);
+ cmdline = malloc(cmdline_size);
if (cmdline == NULL)
return (1);
- sprintf(cmdline, fmt, datadir, bin_path, GENERATOR, bin_path);
+ snprintf(cmdline, cmdline_size, fmt, datadir,
+ bin_path, GENERATOR, bin_path);
system(cmdline);
free(cmdline);
return (0);
@@ -114,6 +118,7 @@ int main(int argc, char *argv[])
int error = 0;
/*int time=1; */
int i;
+ size_t bin_path_size;
/* Generate test ID from invocation name */
if ((TCID = strrchr(argv[0], '/')) != NULL)
@@ -125,11 +130,13 @@ int main(int argc, char *argv[])
tst_brkm(TBROK, NULL,
"You must set $LTPROOT before executing this test");
}
- bin_path = malloc(strlen(ltproot) + 16);
+
+ bin_path_size = strlen(ltproot) + 16;
+ bin_path = malloc(bin_path_size);
if (bin_path == NULL) {
tst_brkm(TBROK | TERRNO, NULL, "malloc failed");
}
- sprintf(bin_path, "%s/testcases/bin", ltproot);
+ snprintf(bin_path, bin_path_size, "%s/testcases/bin", ltproot);
tst_tmpdir();
@@ -432,6 +439,7 @@ static void sys_error(const char *msg, int line)
{
char syserr_msg[256];
- sprintf(syserr_msg, "%s: %s", msg, strerror(errno));
+ snprintf(syserr_msg, sizeof(syserr_msg),
+ "%s: %s", msg, strerror(errno));
error(syserr_msg, line);
}
diff --git a/testcases/misc/math/float/power/genpower.c b/testcases/misc/math/float/power/genpower.c
index 8a8f753a7..6e8356e8e 100644
--- a/testcases/misc/math/float/power/genpower.c
+++ b/testcases/misc/math/float/power/genpower.c
@@ -79,27 +79,33 @@ int main(int argc, char *argv[])
funct = malloc(strlen(bin_path) + MAX_FNAME_LEN);
if (funct == NULL)
err(1, "malloc failed");
- sprintf(funct, "%s/genceil", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genceil", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genfabs", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genfabs", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genfloor", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genfloor", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genfmod", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genfmod", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genpow", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genpow", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/gensqrt", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/gensqrt", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
diff --git a/testcases/misc/math/float/thread_code.c b/testcases/misc/math/float/thread_code.c
index 6f3a463dd..b67edbb34 100644
--- a/testcases/misc/math/float/thread_code.c
+++ b/testcases/misc/math/float/thread_code.c
@@ -47,7 +47,7 @@ static size_t read_file(char *fname, void **data)
int fd;
int maxretries = 1;
- (void)sprintf(path, "%s/%s", datadir, fname);
+ (void)snprintf(path, PATH_MAX, "%s/%s", datadir, fname);
errno = 0;
@@ -135,7 +135,8 @@ static void check_error(TH_DATA * th_data, double e, double r, int index)
++th_data->th_nerror;
/* record first error only ! */
if (th_data->th_result == 0) {
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
errtmplt,
th_data->th_func.fident,
index, e, r, x);
@@ -194,7 +195,8 @@ static void compute_modf(TH_DATA * th_data, double *din, double *dex,
++th_data->th_nerror;
/* record first error only ! */
if (th_data->th_result == 0) {
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
errtmplt1,
th_data->th_func.fident,
index, dex2[index], tmp);
@@ -239,7 +241,8 @@ static void compute_frexp_lgamma(TH_DATA * th_data, double *din, double *dex,
++th_data->th_nerror;
/* record first error only ! */
if (th_data->th_result == 0) {
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
errtmplt2,
th_data->th_func.fident,
index, dex2[index], tmp);
@@ -288,7 +291,8 @@ void *thread_code(void *arg)
fsize = read_file(th_data->th_func.din_fname, (void **)&din);
if (fsize == (size_t) 0) {
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
"FAIL: %s: reading %s, %s\n",
th_data->th_func.fident,
th_data->th_func.din_fname, strerror(errno));
@@ -298,7 +302,8 @@ void *thread_code(void *arg)
}
fsize2 = read_file(th_data->th_func.dex_fname, (void **)&dex);
if (fsize2 == (size_t) 0) {
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
"FAIL: %s: reading %s, %s\n",
th_data->th_func.fident,
th_data->th_func.dex_fname, strerror(errno));
@@ -318,7 +323,8 @@ void *thread_code(void *arg)
case FUNC_GAM:
fsize3 = read_file(th_data->th_func.dex2_fname, (void **)&dex2);
if (fsize3 == (size_t) 0) {
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
"FAIL: %s: reading %s, %s\n",
th_data->th_func.fident,
th_data->th_func.dex2_fname, strerror(errno));
@@ -351,7 +357,8 @@ void *thread_code(void *arg)
break;
default:
file_size_error:
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
"FAIL: %s: file sizes don't match\n",
th_data->th_func.fident);
th_data->th_result = 1;
@@ -395,7 +402,8 @@ file_size_error:
din, dex, (int *)dex2, index);
break;
default:
- sprintf(th_data->detail_data,
+ snprintf(th_data->detail_data,
+ DETAIL_DATA_SIZE,
"FAIL: %s: unexpected function type\n",
th_data->th_func.fident);
th_data->th_result = 1;
diff --git a/testcases/misc/math/float/trigo/gentrigo.c b/testcases/misc/math/float/trigo/gentrigo.c
index 4908d0435..a0c6f2a88 100644
--- a/testcases/misc/math/float/trigo/gentrigo.c
+++ b/testcases/misc/math/float/trigo/gentrigo.c
@@ -80,31 +80,38 @@ int main(int argc, char *argv[])
funct = malloc(strlen(bin_path) + MAX_FNAME_LEN);
if (funct == NULL)
err(1, "malloc failed");
- sprintf(funct, "%s/gencos", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/gencos", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/gensin", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/gensin", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/gentan", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/gentan", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genatan", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genatan", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genatan2", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genatan2", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genacos", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genacos", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
- sprintf(funct, "%s/genasin", bin_path);
+ snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
+ "%s/genasin", bin_path);
child = create_file(funct, 0);
waitpid(child, NULL, 0);
--
2.55.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
next prev parent reply other threads:[~2026-07-15 13:06 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-15 9:45 [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp
2026-07-15 13:04 ` Tomas Dzik via ltp
2026-07-15 9:45 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp
2026-07-15 10:55 ` [LTP] " linuxtestproject.agent
2026-07-15 9:45 ` [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL Tomas Dzik via ltp
2026-07-15 9:45 ` [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests Tomas Dzik via ltp
2026-07-15 13:04 ` [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp
2026-07-15 13:04 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp
2026-07-15 13:04 ` [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL Tomas Dzik via ltp
2026-07-15 13:04 ` Tomas Dzik via ltp [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-07-09 15:40 [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp
2026-07-09 15:40 ` [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests Tomas Dzik via ltp
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9c830e6d52fc6f88fddd98a3b26db614ae8ef8fb.1784119861.git.tdzik@redhat.com \
--to=ltp@lists.linux.it \
--cc=tdzik@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.