|
 |
4a3166 |
From a26eb6eba3f318271d3fbd52152ad43acfc15393 Mon Sep 17 00:00:00 2001
|
|
|
4a3166 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
4a3166 |
Date: Thu, 24 Mar 2022 18:14:50 +0100
|
|
|
4a3166 |
Subject: [PATCH] Fix potential buffer overrun in snprintf() calls
|
|
|
4a3166 |
|
|
|
4a3166 |
When consecutively printing into the same buffer at increasing offset,
|
|
|
4a3166 |
reduce buffer size passed to snprintf() to not defeat its size checking.
|
|
|
4a3166 |
|
|
|
4a3166 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
4a3166 |
(cherry picked from commit 0e05989f3247e9aef0d96aafc144b2d853732891)
|
|
|
4a3166 |
---
|
|
|
4a3166 |
src/process.c | 2 +-
|
|
|
4a3166 |
src/queue.c | 4 ++--
|
|
|
4a3166 |
2 files changed, 3 insertions(+), 3 deletions(-)
|
|
|
4a3166 |
|
|
|
4a3166 |
diff --git a/src/process.c b/src/process.c
|
|
|
4a3166 |
index 3ddad5ffa7959..08598eeae84de 100644
|
|
|
4a3166 |
--- a/src/process.c
|
|
|
4a3166 |
+++ b/src/process.c
|
|
|
4a3166 |
@@ -84,7 +84,7 @@ void fork_process_dump(int fd)
|
|
|
4a3166 |
int size = 0;
|
|
|
4a3166 |
|
|
|
4a3166 |
list_for_each_entry(this, &process_list, head) {
|
|
|
4a3166 |
- size += snprintf(buf+size, sizeof(buf),
|
|
|
4a3166 |
+ size += snprintf(buf + size, sizeof(buf) - size,
|
|
|
4a3166 |
"PID=%u type=%s\n",
|
|
|
4a3166 |
this->pid,
|
|
|
4a3166 |
this->type < CTD_PROC_MAX ?
|
|
|
4a3166 |
diff --git a/src/queue.c b/src/queue.c
|
|
|
4a3166 |
index 76425b18495b5..e94dc7c45d1fd 100644
|
|
|
4a3166 |
--- a/src/queue.c
|
|
|
4a3166 |
+++ b/src/queue.c
|
|
|
4a3166 |
@@ -69,12 +69,12 @@ void queue_stats_show(int fd)
|
|
|
4a3166 |
int size = 0;
|
|
|
4a3166 |
char buf[512];
|
|
|
4a3166 |
|
|
|
4a3166 |
- size += snprintf(buf+size, sizeof(buf),
|
|
|
4a3166 |
+ size += snprintf(buf + size, sizeof(buf) - size,
|
|
|
4a3166 |
"allocated queue nodes:\t\t%12u\n\n",
|
|
|
4a3166 |
qobjects_num);
|
|
|
4a3166 |
|
|
|
4a3166 |
list_for_each_entry(this, &queue_list, list) {
|
|
|
4a3166 |
- size += snprintf(buf+size, sizeof(buf),
|
|
|
4a3166 |
+ size += snprintf(buf + size, sizeof(buf) - size,
|
|
|
4a3166 |
"queue %s:\n"
|
|
|
4a3166 |
"current elements:\t\t%12u\n"
|
|
|
4a3166 |
"maximum elements:\t\t%12u\n"
|
|
|
4a3166 |
--
|
|
|
4a3166 |
2.34.1
|
|
|
4a3166 |
|