Re: [LTP] [PATCH v2] inode02: fix "slash" array overrun

Caspar Zhang
2013-03-20T10:43:56Z

Reviewed-by: Caspar Zhang <caspar@casparzhang.com>

> ---
> testcases/kernel/fs/inode/inode02.c | 26 ++++++++++++++++----------
> 1 files changed, 16 insertions(+), 10 deletions(-)
>
> diff --git a/testcases/kernel/fs/inode/inode02.c b/testcases/kernel/fs/inode/inode02.c
> index 783edf8..54e3927 100644
> --- a/testcases/kernel/fs/inode/inode02.c
> +++ b/testcases/kernel/fs/inode/inode02.c
> @@ -80,7 +80,6 @@ int nchild;
> FILE *list_stream = NULL;
> int list_id;
> int file_id;
> -char slash[1];
>
> int increment_name(), get_next_name(), mode(), escrivez(), massmurder();
> int max_depth, max_breadth, file_length;
> @@ -249,9 +248,7 @@ int tree()
> char path_list_string[PATH_STRING_LENGTH + 10];
> int len;
> int status;
> -
> - slash[0] = '/';
> - slash[1] = '\0';
> + int snp_ret;
>
> /********************************/
> /* */
> @@ -287,9 +284,13 @@ int tree()
> /* */
> /****************************************/
>
> - strcpy(path_list_string, path_string);
> - strcat(path_list_string, slash);
> - strcat(path_list_string, "path_list");
> + snp_ret = snprintf(path_list_string, sizeof(path_list_string),
> + "%s/path_list", path_string);
> + if (snp_ret < 0 || snp_ret >= sizeof(path_list_string)) {
> + tst_resm(TBROK, "snprintf(path_list_string,..) returned %d",
> + snp_ret);
> + exit(-1);
> + }
> list_id = creat(path_list_string, FILE_MODE);
> if (list_id == -1) {
> fprintf(temp,
> @@ -411,6 +412,7 @@ int level; /* the tree depth variable */
> char new_string[PATH_STRING_LENGTH + 1];
> int new_level;
> int i, j; /* iteration counters */
> + int snp_ret;
>
> switch_flag = level & TRUE;
> if (strlen(string) >= MAX_PATH_STRING_LENGTH) {
> @@ -427,9 +429,13 @@ int level; /* the tree depth variable */
> } else if (level < max_depth) {
> for (i = 0; i <= max_breadth; i++) {
> get_next_name();
> - strcpy(new_string, string);
> - strcat(new_string, slash);
> - strcat(new_string, name);
> + snp_ret = snprintf(new_string, sizeof(new_string),
> + "%s/%s", string, name);
> + if (snp_ret < 0 || snp_ret >= sizeof(new_string)) {
> + tst_resm(TBROK, "snprintf(new_string,..) "
> + "returned %d", snp_ret);
> + exit(-1);
> + }
>
> /****************************************/
> /* */