Andrew Geissler | d159c7f | 2021-09-02 21:05:58 -0500 | [diff] [blame^] | 1 | From af2b6f5ee6b171078b18246dd73f71cf6e350859 Mon Sep 17 00:00:00 2001 |
| 2 | From: Marius Hillenbrand <mhillen@linux.ibm.com> |
| 3 | Date: Mon, 19 Jul 2021 13:58:35 +0800 |
| 4 | Subject: [PATCH] syscalls/ioctl_ns05.c, ioctl_ns06.c: Fix too small buffer for |
| 5 | path |
| 6 | |
| 7 | commit af2b6f5ee6b171078b18246dd73f71cf6e350859 upstream. |
| 8 | |
| 9 | Resize the buffer used for paths into /proc/ to grant enough space |
| 10 | for long PIDs. While at it, replace sprintf with snprintf to avoid |
| 11 | buffer overflows if we ever ran out of space again. |
| 12 | |
| 13 | Fixes: #847 |
| 14 | Signed-off-by: Marius Hillenbrand <mhillen@linux.ibm.com> |
| 15 | Reviewed-by: Yang Xu <xuyang2018.jy@fujitsu.com> |
| 16 | Upstream-Status: Backport |
| 17 | Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| 18 | |
| 19 | diff --git a/testcases/kernel/syscalls/ioctl/ioctl_ns05.c b/testcases/kernel/syscalls/ioctl/ioctl_ns05.c |
| 20 | index a67ddbe2c66f..52613810c7ce 100644 |
| 21 | --- a/testcases/kernel/syscalls/ioctl/ioctl_ns05.c |
| 22 | +++ b/testcases/kernel/syscalls/ioctl/ioctl_ns05.c |
| 23 | @@ -59,10 +59,10 @@ static void run(void) |
| 24 | if (pid == -1) |
| 25 | tst_brk(TBROK | TERRNO, "ltp_clone failed"); |
| 26 | |
| 27 | - char child_namespace[20]; |
| 28 | + char child_namespace[30]; |
| 29 | int my_fd, child_fd, parent_fd; |
| 30 | |
| 31 | - sprintf(child_namespace, "/proc/%i/ns/pid", pid); |
| 32 | + snprintf(child_namespace, sizeof(child_namespace), "/proc/%i/ns/pid", pid); |
| 33 | my_fd = SAFE_OPEN("/proc/self/ns/pid", O_RDONLY); |
| 34 | child_fd = SAFE_OPEN(child_namespace, O_RDONLY); |
| 35 | parent_fd = ioctl(child_fd, NS_GET_PARENT); |
| 36 | diff --git a/testcases/kernel/syscalls/ioctl/ioctl_ns06.c b/testcases/kernel/syscalls/ioctl/ioctl_ns06.c |
| 37 | index b6ac80208d02..c30f7de91e09 100644 |
| 38 | --- a/testcases/kernel/syscalls/ioctl/ioctl_ns06.c |
| 39 | +++ b/testcases/kernel/syscalls/ioctl/ioctl_ns06.c |
| 40 | @@ -51,14 +51,14 @@ static int child(void *arg LTP_ATTRIBUTE_UNUSED) |
| 41 | |
| 42 | static void run(void) |
| 43 | { |
| 44 | - char child_namespace[20]; |
| 45 | + char child_namespace[30]; |
| 46 | |
| 47 | pid_t pid = ltp_clone(CLONE_NEWUSER | SIGCHLD, &child, 0, |
| 48 | STACK_SIZE, child_stack); |
| 49 | if (pid == -1) |
| 50 | tst_brk(TBROK | TERRNO, "ltp_clone failed"); |
| 51 | |
| 52 | - sprintf(child_namespace, "/proc/%i/ns/user", pid); |
| 53 | + snprintf(child_namespace, sizeof(child_namespace), "/proc/%i/ns/user", pid); |
| 54 | int my_fd, child_fd, parent_fd; |
| 55 | |
| 56 | my_fd = SAFE_OPEN("/proc/self/ns/user", O_RDONLY); |
| 57 | -- |
| 58 | 2.32.0 |
| 59 | |