netdev - RE: [PATCH iproute2] ifstat: convert sprintf to snprintf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d2e9ab2c4df04f0e8f12b623366123eb@AcuMS.aculab.com>
Date: Fri, 2 Feb 2024 13:02:32 +0000
From: David Laight <David.Laight@...LAB.COM>
To: 'Denis Kirjanov' <dkirjanov@...e.de>, 'Stephen Hemminger'
	<stephen@...workplumber.org>, Denis Kirjanov <kirjanov@...il.com>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH iproute2] ifstat: convert sprintf to snprintf

From: Denis Kirjanov
> Sent: 02 February 2024 12:24
> 
> On 2/2/24 14:32, David Laight wrote:
> > From: Stephen Hemminger
> >> Sent: 31 January 2024 16:14
> >
> >>
> >> On Wed, 31 Jan 2024 07:41:07 -0500
> >> Denis Kirjanov <kirjanov@...il.com> wrote:
> >>
> >>> @@ -893,7 +893,7 @@ int main(int argc, char *argv[])
> >>>
> >>>  	sun.sun_family = AF_UNIX;
> >>>  	sun.sun_path[0] = 0;
> >>> -	sprintf(sun.sun_path+1, "ifstat%d", getuid());
> >>> +	snprintf(sun.sun_path+1, sizeof(sun.sun_path), "ifstat%d", getuid());
> >>
> >> If you are changing the line, please add spaces around plus sign
> >
> > Isn't the size also wrong - needs a matching '- 1'.
> 
> I don't think it's wrong, it's just the size of the target buffer which is
> UNIX_PATH_MAX bytes.

But you are starting one byte in.
So, if the size were 8 the '\0' would be written after the end.

Also, to avoid the next patch in a few weeks it should be
calling scnprintf().

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)