build: fix TagName overflow issues
authorRoss Zwisler <ross.zwisler@linux.intel.com>
Thu, 7 Dec 2017 21:35:02 +0000 (14:35 -0700)
committerEryu Guan <eguan@redhat.com>
Sun, 10 Dec 2017 09:46:05 +0000 (17:46 +0800)
The 'TagName' string is defined to be 40 characters in length, but
in three places we write into it with a format of "(%.39s)".  This
can result in a string of up to 42 characters, the 39 character user
string plus "()\0".  This overflows TagName, as we see in the new
complier warnings from gcc 7.2.1:

iogen.c:1277:6: note: 'sprintf' output between 3 and 42 bytes into a
destination of size 40
  sprintf( TagName, "(%.39s)", optarg );
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix this by limiting the user string to 37 characters.

Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
ltp/doio.c
ltp/growfiles.c
ltp/iogen.c

index dcb3efd8c87dbaeae775a3006960da08b537447b..b93771875650559a0896dc624568d8519cc1219c 100644 (file)
@@ -3184,7 +3184,7 @@ char      *opts;
                        break;
 
                case 'N':
-                       sprintf( TagName, "(%.39s)", optarg );
+                       sprintf( TagName, "(%.37s)", optarg );
                        break;
 
                case 'n':
index fb91761f56c01cb360f608b000e4fc9a51ba3207..ad1ecdf5df3fdf07c27d35ab2f9b3e5d1179b515 100644 (file)
@@ -794,7 +794,7 @@ extern int Forker_npids;    /* num of forked pid, defined in forker.c */
                        break;
 
                case 'W':
-                       sprintf( TagName, "(%.39s)", optarg );
+                       sprintf( TagName, "(%.37s)", optarg );
                        break;
 
                case 'y':
index 1eaab1f0cf8a26fa138d70c4e7f7e6d588798ebc..8fc339e54c34f9ca4775845dfbe583396c36e97b 100644 (file)
@@ -1274,7 +1274,7 @@ char      *opts;
            break;
 
        case 'N':
-           sprintf( TagName, "(%.39s)", optarg );
+           sprintf( TagName, "(%.37s)", optarg );
            break;
 
        case 'o':