xfstests: fix buffer overflow in lstat64.c

PATCH In review Eric Sandeen 2 participants 3 messages Nov 3, 2008 – Nov 12, 2008

lore

Share & tools

lore

Eric Sandeen

author

2008-11-03 22:42 UTC #0 lore raw

PATCH 1/1 xfstests: fix buffer overflow in lstat64.c

lstat64.c was putting an 11-byte string into a 10-byte buffer.

Signed-off-by Eric Sandeen <[email protected]>

---

xfstests/src/lstat64.c +1 -1

Index: xfs-cmds/xfstests/src/lstat64.c
===================================================================
@@ -57,7 +57,7 @@ int
 main(int argc, char **argv)
 {
 	struct stat64	sbuf;
-	char		mode[10];
+	char		mode[11];
 	int		i, c;
 	int		terse_flag = 0;

Christoph Hellwig

2008-11-12 09:58 UTC #1 lore raw

Quoted 1 line · Eric Sandeen

lstat64.c was putting an 11-byte string into a 10-byte buffer.

What about somthing like this instead?

xfstests/src/lstat64.c +1 -2

Index: xfs-cmds/xfstests/src/lstat64.c
===================================================================
@@ -57,7 +57,6 @@ int
 main(int argc, char **argv)
 {
 	struct stat64	sbuf;
-	char		mode[10];
 	int		i, c;
 	int		terse_flag = 0;

@@ -78,6 +77,7 @@ main(int argc, char **argv)
 	time(&timebuf);
 
 	for (i = optind; i < argc; i++) {
+		char *mode = "----------";
 
 		if( lstat64(argv[i], &sbuf) < 0) {
 			perror(argv[i]);

@@ -92,7 +92,6 @@ main(int argc, char **argv)
 			printf("  Size: %-10llu", (unsigned long long)sbuf.st_size);
 		}
 
-		strcpy(mode,"----------");
 		if (sbuf.st_mode & (S_IEXEC>>6))
 			mode[9] = 'x';
 		if (sbuf.st_mode & (S_IWRITE>>6))

Eric Sandeen

author

2008-11-12 13:34 UTC #2 lore raw

Quoted 4 lines · Christoph Hellwig

Quoted 1 line · Eric Sandeen
lstat64.c was putting an 11-byte string into a 10-byte buffer.
What about somthing like this instead?

That's too easy! :)

Sure, that makes good sense.

-Eric

Quoted 30 lines

Index: xfs-cmds/xfstests/src/lstat64.c
===================================================================

xfstests/src/lstat64.c +1 -2

@@ -57,7 +57,6 @@ int
 main(int argc, char **argv)
 {
 	struct stat64	sbuf;
-	char		mode[10];
 	int		i, c;
 	int		terse_flag = 0;

@@ -78,6 +77,7 @@ main(int argc, char **argv)
 	time(&timebuf);
 
 	for (i = optind; i < argc; i++) {
+		char *mode = "----------";
 
 		if( lstat64(argv[i], &sbuf) < 0) {
 			perror(argv[i]);

@@ -92,7 +92,6 @@ main(int argc, char **argv)
 			printf("  Size: %-10llu", (unsigned long long)sbuf.st_size);
 		}
 
-		strcpy(mode,"----------");
 		if (sbuf.st_mode & (S_IEXEC>>6))
 			mode[9] = 'x';
 		if (sbuf.st_mode & (S_IWRITE>>6))