* [PATCH] debugfs: Fix sprintf stack overflow
@ 2011-10-12 1:02 Darrick J. Wong
2011-10-12 2:38 ` Eric Sandeen
2011-11-20 20:47 ` Ted Ts'o
0 siblings, 2 replies; 3+ messages in thread
From: Darrick J. Wong @ 2011-10-12 1:02 UTC (permalink / raw)
To: Theodore Ts'o; +Cc: linux-ext4
The htree dump code overflows a char buffer if the directory has a long
filename because the buffer is not large enough to hold the characters that are
not part of the filename. Make the buffer larger and use snprintf instead.
Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
---
debugfs/htree.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/debugfs/htree.c b/debugfs/htree.c
index 06e7737..05745eb 100644
--- a/debugfs/htree.c
+++ b/debugfs/htree.c
@@ -39,7 +39,7 @@ static void htree_dump_leaf_node(ext2_filsys fs, ext2_ino_t ino,
int thislen, col = 0;
unsigned int offset = 0;
char name[EXT2_NAME_LEN + 1];
- char tmp[EXT2_NAME_LEN + 16];
+ char tmp[EXT2_NAME_LEN + 64];
blk64_t pblk;
ext2_dirhash_t hash, minor_hash;
unsigned int rec_len;
@@ -91,8 +91,8 @@ static void htree_dump_leaf_node(ext2_filsys fs, ext2_ino_t ino,
if (errcode)
com_err("htree_dump_leaf_node", errcode,
"while calculating hash");
- sprintf(tmp, "%u 0x%08x-%08x (%d) %s ", dirent->inode,
- hash, minor_hash, rec_len, name);
+ snprintf(tmp, EXT2_NAME_LEN + 64, "%u 0x%08x-%08x (%d) %s ",
+ dirent->inode, hash, minor_hash, rec_len, name);
thislen = strlen(tmp);
if (col + thislen > 80) {
fprintf(pager, "\n");
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] debugfs: Fix sprintf stack overflow
2011-10-12 1:02 [PATCH] debugfs: Fix sprintf stack overflow Darrick J. Wong
@ 2011-10-12 2:38 ` Eric Sandeen
2011-11-20 20:47 ` Ted Ts'o
1 sibling, 0 replies; 3+ messages in thread
From: Eric Sandeen @ 2011-10-12 2:38 UTC (permalink / raw)
To: djwong; +Cc: Theodore Ts'o, linux-ext4
On 10/11/11 8:02 PM, Darrick J. Wong wrote:
> The htree dump code overflows a char buffer if the directory has a long
> filename because the buffer is not large enough to hold the characters that are
> not part of the filename. Make the buffer larger and use snprintf instead.
>
> Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
lessee ...
"%u 0x%08x-%08x (%d) %s "
%u 10
" " 1
0x 2
%08x 8
- 1
%08x 8
" (" 2
%d 5
"( " 2
%s EXT2_NAME_LEN
" " 3
-------
EXT2_NAME_LEN+42
64 should be plenty :)
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
> ---
>
> debugfs/htree.c | 6 +++---
> 1 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/debugfs/htree.c b/debugfs/htree.c
> index 06e7737..05745eb 100644
> --- a/debugfs/htree.c
> +++ b/debugfs/htree.c
> @@ -39,7 +39,7 @@ static void htree_dump_leaf_node(ext2_filsys fs, ext2_ino_t ino,
> int thislen, col = 0;
> unsigned int offset = 0;
> char name[EXT2_NAME_LEN + 1];
> - char tmp[EXT2_NAME_LEN + 16];
> + char tmp[EXT2_NAME_LEN + 64];
> blk64_t pblk;
> ext2_dirhash_t hash, minor_hash;
> unsigned int rec_len;
> @@ -91,8 +91,8 @@ static void htree_dump_leaf_node(ext2_filsys fs, ext2_ino_t ino,
> if (errcode)
> com_err("htree_dump_leaf_node", errcode,
> "while calculating hash");
> - sprintf(tmp, "%u 0x%08x-%08x (%d) %s ", dirent->inode,
> - hash, minor_hash, rec_len, name);
> + snprintf(tmp, EXT2_NAME_LEN + 64, "%u 0x%08x-%08x (%d) %s ",
> + dirent->inode, hash, minor_hash, rec_len, name);
> thislen = strlen(tmp);
> if (col + thislen > 80) {
> fprintf(pager, "\n");
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: debugfs: Fix sprintf stack overflow
2011-10-12 1:02 [PATCH] debugfs: Fix sprintf stack overflow Darrick J. Wong
2011-10-12 2:38 ` Eric Sandeen
@ 2011-11-20 20:47 ` Ted Ts'o
1 sibling, 0 replies; 3+ messages in thread
From: Ted Ts'o @ 2011-11-20 20:47 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: linux-ext4
On Tue, Oct 11, 2011 at 03:02:21PM -0000, Darrick J. Wong wrote:
> The htree dump code overflows a char buffer if the directory has a long
> filename because the buffer is not large enough to hold the characters that are
> not part of the filename. Make the buffer larger and use snprintf instead.
>
> Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
> Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Thanks, applied.
- Ted
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-11-20 20:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-10-12 1:02 [PATCH] debugfs: Fix sprintf stack overflow Darrick J. Wong
2011-10-12 2:38 ` Eric Sandeen
2011-11-20 20:47 ` Ted Ts'o
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).