From patchwork Thu Dec 7 21:35:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Zwisler X-Patchwork-Id: 10101113 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C86F460360 for ; Thu, 7 Dec 2017 21:35:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BB9281FF87 for ; Thu, 7 Dec 2017 21:35:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B087F2873A; Thu, 7 Dec 2017 21:35:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9C5A420499 for ; Thu, 7 Dec 2017 21:35:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752117AbdLGVfK (ORCPT ); Thu, 7 Dec 2017 16:35:10 -0500 Received: from mga05.intel.com ([192.55.52.43]:19927 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750862AbdLGVfJ (ORCPT ); Thu, 7 Dec 2017 16:35:09 -0500 Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 07 Dec 2017 13:35:09 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,374,1508828400"; d="scan'208";a="185075799" Received: from theros.lm.intel.com ([10.232.112.77]) by fmsmga006.fm.intel.com with ESMTP; 07 Dec 2017 13:35:09 -0800 From: Ross Zwisler To: Eryu Guan , fstests Cc: Ross Zwisler Subject: [PATCH 2/3] xfstests: fix TagName overflow issues Date: Thu, 7 Dec 2017 14:35:02 -0700 Message-Id: <20171207213503.31070-2-ross.zwisler@linux.intel.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20171207213503.31070-1-ross.zwisler@linux.intel.com> References: <20171207213503.31070-1-ross.zwisler@linux.intel.com> Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The 'TagName' string is defined to be 40 characters in length, but in three places we write into it with a format of "(%.39s)". This can result in a string of up to 42 characters, the 39 character user string plus "()\0". This overflows TagName, as we see in the new complier warnings from gcc 7.2.1: iogen.c:1277:6: note: 'sprintf' output between 3 and 42 bytes into a destination of size 40 sprintf( TagName, "(%.39s)", optarg ); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by limiting the user string to 37 characters. Signed-off-by: Ross Zwisler --- ltp/doio.c | 2 +- ltp/growfiles.c | 2 +- ltp/iogen.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ltp/doio.c b/ltp/doio.c index dcb3efd8..b9377187 100644 --- a/ltp/doio.c +++ b/ltp/doio.c @@ -3184,7 +3184,7 @@ char *opts; break; case 'N': - sprintf( TagName, "(%.39s)", optarg ); + sprintf( TagName, "(%.37s)", optarg ); break; case 'n': diff --git a/ltp/growfiles.c b/ltp/growfiles.c index fb91761f..ad1ecdf5 100644 --- a/ltp/growfiles.c +++ b/ltp/growfiles.c @@ -794,7 +794,7 @@ extern int Forker_npids; /* num of forked pid, defined in forker.c */ break; case 'W': - sprintf( TagName, "(%.39s)", optarg ); + sprintf( TagName, "(%.37s)", optarg ); break; case 'y': diff --git a/ltp/iogen.c b/ltp/iogen.c index 1eaab1f0..8fc339e5 100644 --- a/ltp/iogen.c +++ b/ltp/iogen.c @@ -1274,7 +1274,7 @@ char *opts; break; case 'N': - sprintf( TagName, "(%.39s)", optarg ); + sprintf( TagName, "(%.37s)", optarg ); break; case 'o':