From: Darrick J. Wong <djwong@kernel.org>
Date: Thu, 11 Jun 2026 14:05:06 +0000 (-0700)
Subject: libfrog: fix buffer overflow in getparents path_to_string
X-Git-Tag: v7.1.0~45
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=359eeef71fae8d5f6fcb734e6956554964025467;p=xfsprogs-dev.git

libfrog: fix buffer overflow in getparents path_to_string

Codex points out rather indirectly that snprintf returns the number of
bytes that would be formatted into the buffer excluding the null
terminator.  However, it won't format more bytes than the size
parameter, so the proper way to detect overflows is to compare the
return value against the size parameter.  Fix that.

Cc: linux-xfs@vger.kernel.org # v6.10.0
Fixes: 56f6ba21e97756 ("libfrog: add parent pointer support code")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Andrey Albershteyn <aalbersh@kernel.org>
---

diff --git a/libfrog/getparents.c b/libfrog/getparents.c
index e8f54539..8a53c643 100644
--- a/libfrog/getparents.c
+++ b/libfrog/getparents.c
@@ -355,7 +355,7 @@ path_to_string(
 		mntpt_len--;
 
 	ret = snprintf(gpi->buf, gpi->len, "%.*s", mntpt_len, mntpt);
-	if (ret != mntpt_len)
+	if (ret >= gpi->len)
 		return ENAMETOOLONG;
 	gpi->written += ret;