libblkid: avoid 1-byte stack overflow with long partition names
PATCH 1/1 libblkid: avoid 1-byte stack overflow with long partition names
The code in probe_all() parses device names from /proc/partitions into a char[128] buffer using sscanf() %128[...] format specifier.
If the device name is at least 128 bytes long, scanf() will store those 128 bytes plus the null byte, overflowing the buffer by a single byte. Fix by making the buffers 129 bytes long.
Signed-off-by Sami Liedes <[email protected]>
--- lib/blkid/devname.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/blkid/devname.c +1 -1
@@ -394,7 +394,7 @@ static int probe_all(blkid_cache cache, int only_if_new) {FILE *proc;char line[1024 ]; -char ptname0[128 ], ptname1[128 ], *ptname =0 ; +char ptname0[129 ], ptname1[129 ], *ptname =0 ;char *ptnames[2 ];dev_t devs[2 ];int ma, mi;
Signature · 1 line
2.1.3