Skip to contentSkip to conversation

libblkid: avoid 1-byte stack overflow with long partition names

PATCH New Sami Liedes 1 participant 1 message Nov 14, 2014

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 libblkid: avoid 1-byte stack overflow with long partition names

The code in probe_all() parses device names from /proc/partitions into a char[128] buffer using sscanf() %128[...] format specifier.

If the device name is at least 128 bytes long, scanf() will store those 128 bytes plus the null byte, overflowing the buffer by a single byte. Fix by making the buffers 129 bytes long.

---
 lib/blkid/devname.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/blkid/devname.c +1 -1
index 3e2efa9..58baa29 100644
@@ -394,7 +394,7 @@ static int probe_all(blkid_cache cache, int only_if_new)
 {
 	FILE *proc;
 	char line[1024];
-	char ptname0[128], ptname1[128], *ptname = 0;
+	char ptname0[129], ptname1[129], *ptname = 0;
 	char *ptnames[2];
 	dev_t devs[2];
 	int ma, mi;
Signature · 1 line
2.1.3