|
 |
ac32bf |
From 59f6c44864f914a189cb924dd8fea14cc314bf3f Mon Sep 17 00:00:00 2001
|
|
|
ac32bf |
From: Aristeu Rozanski <arozansk@redhat.com>
|
|
|
ac32bf |
Date: Mon, 23 Jun 2014 15:43:41 -0400
|
|
|
ac32bf |
Subject: [PATCH 1/2] rasdaemon: handle failures of snprintf()
|
|
|
ac32bf |
|
|
|
ac32bf |
Florian Weimer found that in bitfield_msg() the return value of
|
|
|
ac32bf |
snprintf() is used to calculate length ignoring that it can return a
|
|
|
ac32bf |
negative number. This patch makes bitfield_msg() to stop writing in such
|
|
|
ac32bf |
case.
|
|
|
ac32bf |
|
|
|
ac32bf |
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1035741
|
|
|
ac32bf |
|
|
|
ac32bf |
Reported-by: Florian Weimer <fweimer@redhat.com>
|
|
|
ac32bf |
Signed-off-by: Aristeu Rozanski <arozansk@redhat.com>
|
|
|
ac32bf |
---
|
|
|
ac32bf |
bitfield.c | 4 ++++
|
|
|
ac32bf |
1 files changed, 4 insertions(+), 0 deletions(-)
|
|
|
ac32bf |
|
|
|
ac32bf |
diff --git a/bitfield.c b/bitfield.c
|
|
|
ac32bf |
index b2895b4..1690f15 100644
|
|
|
ac32bf |
--- a/bitfield.c
|
|
|
ac32bf |
+++ b/bitfield.c
|
|
|
ac32bf |
@@ -41,6 +41,8 @@ unsigned bitfield_msg(char *buf, size_t len, const char **bitarray,
|
|
|
ac32bf |
if (status & (1 << (i + bit_offset))) {
|
|
|
ac32bf |
if (p != buf) {
|
|
|
ac32bf |
n = snprintf(p, len, ", ");
|
|
|
ac32bf |
+ if (n < 0)
|
|
|
ac32bf |
+ break;
|
|
|
ac32bf |
len -= n;
|
|
|
ac32bf |
p += n;
|
|
|
ac32bf |
}
|
|
|
ac32bf |
@@ -48,6 +50,8 @@ unsigned bitfield_msg(char *buf, size_t len, const char **bitarray,
|
|
|
ac32bf |
n = snprintf(p, len, "BIT%d", i + bit_offset);
|
|
|
ac32bf |
else
|
|
|
ac32bf |
n = snprintf(p, len, "%s", bitarray[i]);
|
|
|
ac32bf |
+ if (n < 0)
|
|
|
ac32bf |
+ break;
|
|
|
ac32bf |
len -= n;
|
|
|
ac32bf |
p += n;
|
|
|
ac32bf |
}
|
|
|
ac32bf |
--
|
|
|
ac32bf |
1.7.1
|
|
|
ac32bf |
|