[PATCH 4/7] kvmtool: check strncpy return value

[PATCH 4/7] kvmtool: check strncpy return value

[G. Campana]

---
 virtio/9p.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/virtio/9p.c b/virtio/9p.c
index cd93d06..87a579f 100644
--- a/virtio/9p.c
+++ b/virtio/9p.c
@@ -424,7 +424,11 @@ static void virtio_p9_walk(struct p9_dev *p9dev,
 	if (nwname) {
 		struct p9_fid *fid = get_fid(p9dev, fid_val);
 
-		join_path(new_fid, fid->path);
+		if (join_path(new_fid, fid->path) != 0) {
+			errno = ENAMETOOLONG;
+			goto err_out;
+		}
+
 		/* skip the space for count */
 		pdu->write_offset += sizeof(u16);
 		for (i = 0; i < nwname; i++) {
@@ -432,11 +436,16 @@ static void virtio_p9_walk(struct p9_dev *p9dev,
 			char tmp[PATH_MAX] = {0};
 			char full_path[PATH_MAX];
 			char *str;
+			int ret;
 
 			virtio_p9_pdu_readf(pdu, "s", &str);
 
 			/* Format the new path we're 'walk'ing into */
-			sprintf(tmp, "%s/%s", new_fid->path, str);
+			ret = snprintf(tmp, sizeof(tmp), "%s/%s", new_fid->path, str);
+			if (ret >= (int)sizeof(tmp)) {
+				errno = ENAMETOOLONG;
+				goto err_out;
+			}
 
 			free(str);
 
@@ -444,7 +453,10 @@ static void virtio_p9_walk(struct p9_dev *p9dev,
 				goto err_out;
 
 			stat2qid(&st, &wqid);
-			join_path(new_fid, tmp);
+			if (join_path(new_fid, tmp) != 0) {
+				errno = ENAMETOOLONG;
+				goto err_out;
+			}
 			new_fid->uid = fid->uid;
 			nwqid++;
 			virtio_p9_pdu_writef(pdu, "Q", &wqid);
@@ -455,7 +467,10 @@ static void virtio_p9_walk(struct p9_dev *p9dev,
 		 */
 		pdu->write_offset += sizeof(u16);
 		old_fid = get_fid(p9dev, fid_val);
-		join_path(new_fid, old_fid->path);
+		if (join_path(new_fid, old_fid->path) != 0) {
+			errno = ENAMETOOLONG;
+			goto err_out;
+		}
 		new_fid->uid    = old_fid->uid;
 	}
 	*outlen = pdu->write_offset;
@@ -491,7 +506,10 @@ static void virtio_p9_attach(struct p9_dev *p9dev,
 
 	fid = get_fid(p9dev, fid_val);
 	fid->uid = uid;
-	join_path(fid, "/");
+	if (join_path(fid, "/") != 0) {
+		errno = ENAMETOOLONG;
+		goto err_out;
+	}
 
 	virtio_p9_pdu_writef(pdu, "Q", &qid);
 	*outlen = pdu->write_offset;
-- 
2.7.4

Re: [PATCH 4/7] kvmtool: check strncpy return value

[Will Deacon]

On Tue, Oct 18, 2016 at 06:02:56PM +0200, G. Campana wrote:
> ---
>  virtio/9p.c | 28 +++++++++++++++++++++++-----
>  1 file changed, 23 insertions(+), 5 deletions(-)
> 
> diff --git a/virtio/9p.c b/virtio/9p.c
> index cd93d06..87a579f 100644
> --- a/virtio/9p.c
> +++ b/virtio/9p.c
> @@ -424,7 +424,11 @@ static void virtio_p9_walk(struct p9_dev *p9dev,
>  	if (nwname) {
>  		struct p9_fid *fid = get_fid(p9dev, fid_val);
>  
> -		join_path(new_fid, fid->path);
> +		if (join_path(new_fid, fid->path) != 0) {
> +			errno = ENAMETOOLONG;
> +			goto err_out;
> +		}

This patch should be merged in with the introduction of join_path.

Will