Skip to content

Commit

Permalink
fscache: fix fscache_objlist_show format processing
Browse files Browse the repository at this point in the history
gcc points out a minor bug in the handling of unknown cookie types,
which could result in a string overflow when the integer is copied into
a 3-byte string:

  fs/fscache/object-list.c: In function 'fscache_objlist_show':
  fs/fscache/object-list.c:265:19: error: 'sprintf' may write a terminating nul past the end of the destination [-Werror=format-overflow=]
   sprintf(_type, "%02u", cookie->def->type);
                  ^~~~~~
  fs/fscache/object-list.c:265:4: note: 'sprintf' output between 3 and 4 bytes into a destination of size 3

This is currently harmless as no code sets a type other than 0 or 1, but
it makes sense to use snprintf() here to avoid overflowing the array if
that changes.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Arnd Bergmann <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
arndb authored and torvalds committed Sep 14, 2017
1 parent 8185f57 commit ebfddb3
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion fs/fscache/object-list.c
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,8 @@ static int fscache_objlist_show(struct seq_file *m, void *v)
type = "DT";
break;
default:
sprintf(_type, "%02u", cookie->def->type);
snprintf(_type, sizeof(_type), "%02u",
cookie->def->type);
type = _type;
break;
}
Expand Down

0 comments on commit ebfddb3

Please sign in to comment.