lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sat, 12 Feb 2011 16:48:58 +0300
From:	Michael Tokarev <>
To:	"Daniel K." <>
CC:	Jesper Juhl <>,,, Neil Brown <>,
	Neil Brown <>
Subject: Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf()
 in md_check_recovery()

12.02.2011 12:34, Daniel K. wrote:
> Jesper Juhl wrote:
>> sprintf() is dangerous - given the wrong source string it will
>> overflow the destination. snprintf() is safer in that at least we'll
>> never overflow the destination. Even if overflow will never happen
>> today, code changes over time and snprintf() is just safer in the long
>> run.
>> -                        sprintf(nm,"rd%d", rdev->raid_disk);
>> +                        snprintf(nm, sizeof(nm), "rd%d",
>> rdev->raid_disk);
>>                          sysfs_remove_link(&mddev->kobj, nm);
> What if "rd1234" get truncated to "rd123" and you remove the wrong link.
> (No, I didn't actually bother to check how much room was allocated.)

That allocation is in the line above first sprintf which you deleted.
Sure, didn't bother, it's very difficult.

C'mon guys, this is pointless.  20 bytes allocated for the device
name, and this is for raid disk number.  It is impossible to have
more than 10^17 (20 bytes total, 2 for "rd" and on for the zero
terminator) drives in a single array.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists