Re: sg_dd bpt= count=

[Pat LaVarre <p.lavarre@ieee.org>]

> > sudo sg_dd of=/dev/sg0 if=/dev/zero bs=2k bpt= count=
> > may reliably take down kernels.

To sg3_utils sg_dd.c I first propose the following patch, to persuade
get_num to return determinate results more often.

Specifically I propose changing:

        char c;
        res = sscanf(buf, "%d%c", &num, &c);
        if (0 == res) ...
        else if (1 == res) ...
        else {
                switch (c) { ...

Personally I believe that source fragment switches on uninitialised c in
the situation `man sscanf` describes as: "RETURN VALUE ... The value EOF
is returned if an input failure occurs before any conversion such as an
end-of-file occurs ...".

As a test, I did separately execute get_num("").  For me once the
uninitialised c and num were then 8 and 1108545272 (aka x42130EF8), so
the result was -1.  I notice gcc -Wall doesn't mention this kind of
read-before-write.

Pat LaVarre

P.S. Also I wonder if we would prefer rewriting these "return -1" as
loud exits e.g.:

fprintf(stderr, "file %s line %d\n", __FILE__, __LINE__);
exit(-1);

--- sg3_utils-1.05/sg_dd.c	2003-10-19 03:35:32.000000000 -0600
+++ sg3_utils/sg_dd.c	2003-10-20 13:35:20.515143520 -0600
@@ -475,10 +475,10 @@
     char c;
 
     res = sscanf(buf, "%d%c", &num, &c);
-    if (0 == res)
-        return -1;
-    else if (1 == res)
+    if (1 == res)
         return num;
+    else if (2 != res)
+        return -1;
     else {
         switch (c) {
         case 'c':