Buffer overrun in some calls to sscanf

Buffer overrun in some calls to sscanf

[Sergei Antonov]

Hello!
Take a look at these 7 places where sscanf may write 1 zero byte past
the end of the array.
To fix this either decrease the %N limit or increase array size.

util-linux/libblkid/src/devno.c:

		char name[64];

		if (sscanf(buf, "%d %64[^\n ]", &maj, name) != 2)


util-linux/libblkid/src/devname.c:

	char ptname0[128], ptname1[128], *ptname = 0;
	char *ptnames[2];

...

	int which = 0, last = 0;

...

	ptnames[0] = ptname0;
	ptnames[1] = ptname1;

...

		which ^= 1;
		ptname = ptnames[which];

		if (sscanf(line, " %d %d %llu %128[^\n ]",
			   &ma, &mi, &sz, ptname) != 4)


util-linux/lib/sysfs.c:

	char buf[1024];
	return sysfs_scanf(cxt, attr, "%1024[^\n]", buf) == 1 ?
						strdup(buf) : NULL;


util-linux/lib/loopdev.c:

		char name[128];


		if (sscanf(buf, " %u %*s %*s %128[^\n ]",
			   &m, name) != 2 || m != LOOPDEV_MAJOR)


util-linux/fdisks/sfdisk.c:

    char line[1024], ptname[128];

...

	if (sscanf(line, " %d %d %llu %128[^\n ]", &ma, &mi, &sz, ptname) != 4)


util-linux/fdisks/fdisk.c:

	char line[128], ptname[128], devname[256];

...

		if (sscanf (line, " %d %d %llu %128[^\n ]",
			    &ma, &mi, &sz, ptname) != 4)


util-linux/disk-utils/blockdev.c:

	char ptname[200];

...

		if (sscanf(line, " %d %d %d %200[^\n ]",
			   &ma, &mi, &sz, ptname) != 4)

Re: Buffer overrun in some calls to sscanf

[Karel Zak]

On Mon, Jul 09, 2012 at 07:15:57PM +0200, Sergei Antonov wrote:
> Take a look at these 7 places where sscanf may write 1 zero byte past
> the end of the array.
> To fix this either decrease the %N limit or increase array size.

 Fixed, thanks!

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com