Re: [Qemu-devel] [PATCH 2/3] hw/9pfs/virtio-9p-local.c: use snprintf() instead of sprintf()

[Markus Armbruster]

Chen Gang <address@hidden> writes:

> 'ctx->fs_root' + 'path'/'fullname.data' may be larger than PATH_MAX, so
> need use snprintf() instead of sprintf() just like another area have done in 
> 9pfs.
>
> Signed-off-by: Chen Gang <address@hidden>
> ---
>  hw/9pfs/virtio-9p-local.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/hw/9pfs/virtio-9p-local.c b/hw/9pfs/virtio-9p-local.c
> index 77a04cd..61be75a 100644
> --- a/hw/9pfs/virtio-9p-local.c
> +++ b/hw/9pfs/virtio-9p-local.c
> @@ -898,7 +898,8 @@ static int local_remove(FsContext *ctx, const char *path)
>           * directory
>           */
>          if (S_ISDIR(stbuf.st_mode)) {
> -            sprintf(buffer, "%s/%s/%s", ctx->fs_root, path, VIRTFS_META_DIR);
> +            snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s",
> +                     ctx->fs_root, path, VIRTFS_META_DIR);
>              err = remove(buffer);
>              if (err < 0 && errno != ENOENT) {
>                  /*
> @@ -1033,8 +1034,8 @@ static int local_unlinkat(FsContext *ctx, V9fsPath *dir,
>               * If directory remove .virtfs_metadata contained in the
>               * directory
>               */
> -            sprintf(buffer, "%s/%s/%s", ctx->fs_root,
> -                    fullname.data, VIRTFS_META_DIR);
> +            snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s", ctx->fs_root,
> +                     fullname.data, VIRTFS_META_DIR);
>              ret = remove(buffer);
>              if (ret < 0 && errno != ENOENT) {
>                  /*

Turns a buffer overrun bug into a truncation bug.  The next commit fixes
truncation bugs including this one.  Would be nice to spell this out in
the commit message.  Perhaps Aneesh can do it on commit.