[PATCH] debugfs: Fix sprintf stack overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The htree dump code overflows a char buffer if the directory has a long
filename because the buffer is not large enough to hold the characters that are
not part of the filename.  Make the buffer larger and use snprintf instead.

Signed-off-by: Darrick J. Wong <djwong@xxxxxxxxxx>
---

 debugfs/htree.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/debugfs/htree.c b/debugfs/htree.c
index 06e7737..05745eb 100644
--- a/debugfs/htree.c
+++ b/debugfs/htree.c
@@ -39,7 +39,7 @@ static void htree_dump_leaf_node(ext2_filsys fs, ext2_ino_t ino,
 	int		thislen, col = 0;
 	unsigned int	offset = 0;
 	char		name[EXT2_NAME_LEN + 1];
-	char		tmp[EXT2_NAME_LEN + 16];
+	char		tmp[EXT2_NAME_LEN + 64];
 	blk64_t		pblk;
 	ext2_dirhash_t 	hash, minor_hash;
 	unsigned int	rec_len;
@@ -91,8 +91,8 @@ static void htree_dump_leaf_node(ext2_filsys fs, ext2_ino_t ino,
 		if (errcode)
 			com_err("htree_dump_leaf_node", errcode,
 				"while calculating hash");
-		sprintf(tmp, "%u 0x%08x-%08x (%d) %s   ", dirent->inode,
-			hash, minor_hash, rec_len, name);
+		snprintf(tmp, EXT2_NAME_LEN + 64, "%u 0x%08x-%08x (%d) %s   ",
+			dirent->inode, hash, minor_hash, rec_len, name);
 		thislen = strlen(tmp);
 		if (col + thislen > 80) {
 			fprintf(pager, "\n");

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Reiser Filesystem Development]     [Ceph FS]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite National Park]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]     [Linux Media]

  Powered by Linux