The string we were sprintf'ing is trivially longer than the array
we allocated for it.
Allocate something big enough, and snprintf to avoid overflow
Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxx>
---
dump/content.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/dump/content.c b/dump/content.c
index ac19021..786fc52 100644
--- a/dump/content.c
+++ b/dump/content.c
@@ -6174,7 +6174,7 @@ static bool_t
Media_prompt_overwrite( drive_t *drivep )
{
fold_t fold;
- char question[ 100 ];
+ char question[ 110 ];
char *preamblestr[ PREAMBLEMAX ];
size_t preamblecnt;
char *querystr[ QUERYMAX ];
@@ -6201,7 +6201,7 @@ retry:
/* query: ask if overwrite ok
*/
- sprintf( question,
+ snprintf( question, sizeof(question),
"overwrite data on media in "
"drive %u?\n",
(unsigned int)drivep->d_index );
--
1.7.1
_______________________________________________
xfs mailing list
xfs@xxxxxxxxxxx
http://oss.sgi.com/mailman/listinfo/xfs
