From: Eric Sandeen <sandeen@sandeen.net>
To: Eric Sandeen <sandeen@redhat.com>, xfs@oss.sgi.com
Subject: [PATCH 2/9 V2] xfsdump: Fix overflow of "question" string in Media_prompt_erase()
Date: Wed, 12 Nov 2014 13:05:30 -0600 [thread overview]
Message-ID: <5463AF7A.8040006@sandeen.net> (raw)
In-Reply-To: <1415818638-32700-3-git-send-email-sandeen@redhat.com>
The string we were sprintf'ing is trivially longer than the array
we allocated for it.
Use asprintf instead, as suggested by Christoph.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
V2: use asprintf
diff --git a/dump/content.c b/dump/content.c
index ac19021..43756e3 100644
--- a/dump/content.c
+++ b/dump/content.c
@@ -6174,7 +6174,7 @@ static bool_t
Media_prompt_overwrite( drive_t *drivep )
{
fold_t fold;
- char question[ 100 ];
+ char *question;
char *preamblestr[ PREAMBLEMAX ];
size_t preamblecnt;
char *querystr[ QUERYMAX ];
@@ -6201,9 +6201,8 @@ retry:
/* query: ask if overwrite ok
*/
- sprintf( question,
- "overwrite data on media in "
- "drive %u?\n",
+ asprintf( &question,
+ "overwrite data on media in drive %u?\n",
(unsigned int)drivep->d_index );
querycnt = 0;
querystr[ querycnt++ ] = question;
@@ -6250,6 +6249,8 @@ retry:
dlog_end( postamblestr,
postamblecnt );
+ free(question);
+
if ( responseix == sigintix ) {
if ( cldmgr_stop_requested( )) {
return BOOL_FALSE;
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next prev parent reply other threads:[~2014-11-12 19:05 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-12 18:57 [PATCH 0/9] Random xfsdump fixes Eric Sandeen
2014-11-12 18:57 ` [PATCH 1/9] xfsdump: don't try to close fd from failed open Eric Sandeen
2014-11-12 18:57 ` [PATCH 2/9] xfsdump: Fix overflow of "question" string in Media_prompt_erase() Eric Sandeen
2014-11-12 18:58 ` Christoph Hellwig
2014-11-12 19:05 ` Eric Sandeen [this message]
2014-11-13 17:38 ` [PATCH 2/9 V2] " Christoph Hellwig
2014-11-13 18:00 ` Eric Sandeen
2014-11-12 18:57 ` [PATCH 3/9] xfsdump: fix wrong test for hard stack limit change failure Eric Sandeen
2014-11-12 18:57 ` [PATCH 4/9] xfsdump: remove pointless if (dirty); Eric Sandeen
2014-11-13 17:35 ` Mark Tinguely
2014-11-13 17:47 ` Eric Sandeen
2014-11-13 19:02 ` Mark Tinguely
2014-11-12 18:57 ` [PATCH 5/9] xfsdump: remove some unreachable code Eric Sandeen
2014-11-12 18:57 ` [PATCH 6/9] xfsdump: free suboptstrs if mlog_init1 fails Eric Sandeen
2014-11-12 18:57 ` [PATCH 7/9] xfsdump: free allocated persistent paths Eric Sandeen
2014-11-12 18:57 ` [PATCH 8/9] xfsdump: children[] is an array of child pointers, not of child structures Eric Sandeen
2014-11-12 18:57 ` [PATCH 9/9] xfsdump: fix uninit ackstr in content_mediachange_query() Eric Sandeen
2014-11-13 18:10 ` Mark Tinguely
2014-11-13 19:23 ` Eric Sandeen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5463AF7A.8040006@sandeen.net \
--to=sandeen@sandeen.net \
--cc=sandeen@redhat.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox