[lvm-devel] [PATCH 6/6] cmirrord: avoid resync buffer overflow in LOG_SPRINT

Ferenc Wágner wferi at niif.hu
Wed Jul 8 12:41:27 UTC 2015


Use snprintf() instead of sprintf() to exclude the possibility of
overflowing the resync history buffers.
---
 daemons/cmirrord/functions.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/daemons/cmirrord/functions.c b/daemons/cmirrord/functions.c
index f6e0918..61b3e11 100644
--- a/daemons/cmirrord/functions.c
+++ b/daemons/cmirrord/functions.c
@@ -32,12 +32,13 @@
 #define LOG_OFFSET 2
 
 #define RESYNC_HISTORY 50
+#define RESYNC_BUFLEN 128
 //static char resync_history[RESYNC_HISTORY][128];
 //static int idx = 0;
 #define LOG_SPRINT(_lc, f, arg...) do {					\
 		lc->idx++;						\
 		lc->idx = lc->idx % RESYNC_HISTORY;			\
-		sprintf(lc->resync_history[lc->idx], f, ## arg);	\
+		snprintf(lc->resync_history[lc->idx], RESYNC_BUFLEN, f, ## arg); \
 	} while (0)
 
 struct log_header {
@@ -88,7 +89,7 @@ struct log_c {
 	size_t disk_size;       /* size of disk_buffer in bytes */
 	void *disk_buffer;      /* aligned memory for O_DIRECT */
 	int idx;
-	char resync_history[RESYNC_HISTORY][128];
+	char resync_history[RESYNC_HISTORY][RESYNC_BUFLEN];
 };
 
 struct mark_entry {
-- 
1.7.10.4




More information about the lvm-devel mailing list