Re: [PATCH 1/1] block: partition: aix: bound LV name formatting

[Philippe De Muyter <phdm@macqel.be>]

Hello tt roxy,

On Sat, Jun 27, 2026 at 12:37:50PM +0800, tt roxy wrote:
> On Sat, Jun 27, 2026 at 4:50 AM Philippe De Muyter <phdm@macqel.be> wrote:
> >
> > Hello Ren Wei,
> >
> > On Fri, Jun 26, 2026 at 03:21:22PM +0800, Ren Wei wrote:
> > > From: Zhiling Zou <roxy520tt@gmail.com>
> > > @@ -273,7 +274,8 @@ int aix_partition(struct parsed_partitions *state)
> > >                       if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) {
> > >                               char tmp[sizeof(n[i].name) + 1]; // null char
> > >
> > > -                             snprintf(tmp, sizeof(tmp), "%s", n[i].name);
> > > +                             snprintf(tmp, sizeof(tmp), "%.*s",
> > > +                                      (int)sizeof(n[i].name), n[i].name);
> >
> > Is this change necessary ? snprintf always adds a NULL terminator and
> > truncates the input if needed, isn't it ?
> >
> 
> Yes, snprintf() guarantees that the destination buffer is
> NUL-terminated and truncates the output.
> 
> However, with %s and no precision, snprintf() still treats n[i].name as
> a NUL-terminated source string. If the on-disk fixed-size name field is
> not NUL-terminated, snprintf() can keep reading past the end of
> n[i].name while looking for the terminator, before truncating the output
> into tmp.
> 
> So the issue is not an overflow of tmp, but an out-of-bounds read from
> the fixed-width source field. The precision is needed to bound that
> source read to sizeof(n[i].name).
> 
> > >                               pr_warn("partition %s (%u pp's found) is "
> > >                                       "not contiguous\n",
> > >                                       tmp, lvip[i].pps_found);
> > > --

Actually the 'tmp' buffer is not needed.  Printing directky n[i].name
with '%.*s' in pr_warn would be enough to fix the problem IMHO.

Philippe