[LTP] [PATCH v2] inode02: fix "slash" array overrun

Jan Stancek
2013-03-20T09:44:48Z

Remove "slash" array and convert strcat to snprintf.

Signed-off-by: Jan Stancek <jstancek@redhat.com>
---
testcases/kernel/fs/inode/inode02.c | 26 ++++++++++++++++----------
1 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/testcases/kernel/fs/inode/inode02.c b/testcases/kernel/fs/inode/inode02.c
index 783edf8..54e3927 100644
--- a/testcases/kernel/fs/inode/inode02.c
+++ b/testcases/kernel/fs/inode/inode02.c
@@ -80,7 +80,6 @@ int nchild;
FILE *list_stream = NULL;
int list_id;
int file_id;
-char slash[1];

int increment_name(), get_next_name(), mode(), escrivez(), massmurder();
int max_depth, max_breadth, file_length;
@@ -249,9 +248,7 @@ int tree()
char path_list_string[PATH_STRING_LENGTH + 10];
int len;
int status;
-
- slash[0] = '/';
- slash[1] = '\0';
+ int snp_ret;

/********************************/
/* */
@@ -287,9 +284,13 @@ int tree()
/* */
/****************************************/

- strcpy(path_list_string, path_string);
- strcat(path_list_string, slash);
- strcat(path_list_string, "path_list");
+ snp_ret = snprintf(path_list_string, sizeof(path_list_string),
+ "%s/path_list", path_string);
+ if (snp_ret < 0 || snp_ret >= sizeof(path_list_string)) {
+ tst_resm(TBROK, "snprintf(path_list_string,..) returned %d",
+ snp_ret);
+ exit(-1);
+ }
list_id = creat(path_list_string, FILE_MODE);
if (list_id == -1) {
fprintf(temp,
@@ -411,6 +412,7 @@ int level; /* the tree depth variable */
char new_string[PATH_STRING_LENGTH + 1];
int new_level;
int i, j; /* iteration counters */
+ int snp_ret;

switch_flag = level & TRUE;
if (strlen(string) >= MAX_PATH_STRING_LENGTH) {
@@ -427,9 +429,13 @@ int level; /* the tree depth variable */
} else if (level < max_depth) {
for (i = 0; i <= max_breadth; i++) {
get_next_name();
- strcpy(new_string, string);
- strcat(new_string, slash);
- strcat(new_string, name);
+ snp_ret = snprintf(new_string, sizeof(new_string),
+ "%s/%s", string, name);
+ if (snp_ret < 0 || snp_ret >= sizeof(new_string)) {
+ tst_resm(TBROK, "snprintf(new_string,..) "
+ "returned %d", snp_ret);
+ exit(-1);
+ }

/****************************************/
/* */
--
1.7.1