]> xenbits.xensource.com Git - xen.git/commitdiff
tools/misc: fix hypothetical buffer overflow in xen-lowmemd
authorMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Thu, 5 Apr 2018 01:50:50 +0000 (03:50 +0200)
committerWei Liu <wei.liu2@citrix.com>
Fri, 6 Apr 2018 08:05:51 +0000 (09:05 +0100)
gcc-8 complains:

    xen-lowmemd.c: In function 'handle_low_mem':
    xen-lowmemd.c:80:55: error: '%s' directive output may be truncated writing up to 511 bytes into a region of size 489 [-Werror=format-truncation=]
             snprintf(error, BUFSZ,"Failed to write target %s to xenstore", data);
                                                           ^~               ~~~~
    xen-lowmemd.c:80:9: note: 'snprintf' output between 36 and 547 bytes into a destination of size 512
             snprintf(error, BUFSZ,"Failed to write target %s to xenstore", data);
             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In practice it wouldn't happen, because 'data' contains string
representation of 64-bit unsigned number (20 characters at most).
But place a limit to mute gcc warning.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Release-Acked-by: Juergen Gross <jgross@suse.com>
tools/misc/xen-lowmemd.c

index 865a54cec1830601b1871dbe3cedc63ef2c9565e..79ad34cb4a237ffc41fc908fdba46a783ce0a9a6 100644 (file)
@@ -77,7 +77,7 @@ void handle_low_mem(void)
     if (!xs_write(xs_handle, XBT_NULL, 
             "/local/domain/0/memory/target", data, strlen(data)))
     {
-        snprintf(error, BUFSZ,"Failed to write target %s to xenstore", data);
+        snprintf(error, BUFSZ,"Failed to write target %.24s to xenstore", data);
         perror(error);
     }
 }