Chen Gang <[email protected]> writes: > On 03/03/2014 04:34 PM, Markus Armbruster wrote: >> Chen Gang <[email protected]> writes: >> >>> 'ctx->fs_root' + 'path'/'fullname.data' may be larger than PATH_MAX, so >>> need use snprintf() instead of sprintf() just like another area have done >>> in 9pfs. >>> >>> Signed-off-by: Chen Gang <[email protected]> >>> --- >>> hw/9pfs/virtio-9p-local.c | 7 ++++--- >>> 1 file changed, 4 insertions(+), 3 deletions(-) >>> >>> diff --git a/hw/9pfs/virtio-9p-local.c b/hw/9pfs/virtio-9p-local.c >>> index 77a04cd..61be75a 100644 >>> --- a/hw/9pfs/virtio-9p-local.c >>> +++ b/hw/9pfs/virtio-9p-local.c >>> @@ -898,7 +898,8 @@ static int local_remove(FsContext *ctx, const char >>> *path) >>> * directory >>> */ >>> if (S_ISDIR(stbuf.st_mode)) { >>> - sprintf(buffer, "%s/%s/%s", ctx->fs_root, path, >>> VIRTFS_META_DIR); >>> + snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s", >>> + ctx->fs_root, path, VIRTFS_META_DIR); >>> err = remove(buffer); >>> if (err < 0 && errno != ENOENT) { >>> /* >>> @@ -1033,8 +1034,8 @@ static int local_unlinkat(FsContext *ctx, V9fsPath >>> *dir, >>> * If directory remove .virtfs_metadata contained in the >>> * directory >>> */ >>> - sprintf(buffer, "%s/%s/%s", ctx->fs_root, >>> - fullname.data, VIRTFS_META_DIR); >>> + snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s", ctx->fs_root, >>> + fullname.data, VIRTFS_META_DIR); >>> ret = remove(buffer); >>> if (ret < 0 && errno != ENOENT) { >>> /* >> >> Turns a buffer overrun bug into a truncation bug. The next commit fixes >> truncation bugs including this one. Would be nice to spell this out in >> the commit message. Perhaps Aneesh can do it on commit. >> > > Please help doing it on commit.
Will update when i am applyting this to my tree. -aneesh
