[Xen-devel] [PATCH v2] tools: libxenstat: fix format string overflow

[Dario Faggioli <dfaggioli@xxxxxxxx>]

With gcc 7.3.0, the build fails like this:

src/xenstat_linux.c: In function ‘getBridge’
src/xenstat_linux.c:78:34: warning: ‘%s’ directive writing up to 255 bytes into 
a region of size 241 [-Wformat-overflow=]
     sprintf(tmp, "/sys/class/net/%s/bridge", de->d_name);
                                  ^~
src/xenstat_linux.c:78:5: note: ‘sprintf’ output between 23 and 278 bytes into 
a destination of size 256
     sprintf(tmp, "/sys/class/net/%s/bridge", de->d_name);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix by making the buffer bigger.

Signed-off-by: Dario Faggioli <dfaggioli@xxxxxxxx>
---
Cc: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
Cc: Wei Liu <wei.liu2@xxxxxxxxxx>
Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
Changes from v1:
- increase the buffer istead of using asprintf().
---
 tools/xenstat/libxenstat/src/xenstat_linux.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xenstat/libxenstat/src/xenstat_linux.c 
b/tools/xenstat/libxenstat/src/xenstat_linux.c
index 907d65fa63..7cdd3bf91f 100644
--- a/tools/xenstat/libxenstat/src/xenstat_linux.c
+++ b/tools/xenstat/libxenstat/src/xenstat_linux.c
@@ -69,7 +69,7 @@ void getBridge(char *excludeName, char *result, size_t 
resultLen)
        struct dirent *de;
        DIR *d;
 
-       char tmp[256] = { 0 };
+       char tmp[512] = { 0 };
 
        d = opendir("/sys/class/net");
        while ((de = readdir(d)) != NULL) {


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel