Hello!
Take a look at these 7 places where sscanf may write 1 zero byte past
the end of the array.
To fix this either decrease the %N limit or increase array size.
util-linux/libblkid/src/devno.c:
char name[64];
if (sscanf(buf, "%d %64[^\n ]", &maj, name) != 2)
util-linux/libblkid/src/devname.c:
char ptname0[128], ptname1[128], *ptname = 0;
char *ptnames[2];
...
int which = 0, last = 0;
...
ptnames[0] = ptname0;
ptnames[1] = ptname1;
...
which ^= 1;
ptname = ptnames[which];
if (sscanf(line, " %d %d %llu %128[^\n ]",
&ma, &mi, &sz, ptname) != 4)
util-linux/lib/sysfs.c:
char buf[1024];
return sysfs_scanf(cxt, attr, "%1024[^\n]", buf) == 1 ?
strdup(buf) : NULL;
util-linux/lib/loopdev.c:
char name[128];
if (sscanf(buf, " %u %*s %*s %128[^\n ]",
&m, name) != 2 || m != LOOPDEV_MAJOR)
util-linux/fdisks/sfdisk.c:
char line[1024], ptname[128];
...
if (sscanf(line, " %d %d %llu %128[^\n ]", &ma, &mi, &sz, ptname) != 4)
util-linux/fdisks/fdisk.c:
char line[128], ptname[128], devname[256];
...
if (sscanf (line, " %d %d %llu %128[^\n ]",
&ma, &mi, &sz, ptname) != 4)
util-linux/disk-utils/blockdev.c:
char ptname[200];
...
if (sscanf(line, " %d %d %d %200[^\n ]",
&ma, &mi, &sz, ptname) != 4)
--
To unsubscribe from this list: send the line "unsubscribe util-linux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
