Ensure that set_name_idx() doesn't exceed target bounds

Signed-off-by: Jens Axboe <axboe@fb.com>

diff --git a/filesetup.c b/filesetup.c
index 10fc4150804b8fadce1a4af7cb856828796ca1f8..aee7ece9da3a8829fedc0884dfff3f0bb00ca182 100644 (file)
--- a/filesetup.c
+++ b/filesetup.c
@@ -1262,7 +1262,7 @@ int add_file(struct thread_data *td, const char *fname, int numjob, int inc)
        dprint(FD_FILE, "add file %s\n", fname);
 
        if (td->o.directory)
-               len = set_name_idx(file_name, td->o.directory, numjob);
+               len = set_name_idx(file_name, PATH_MAX, td->o.directory, numjob);
 
        sprintf(file_name + len, "%s", fname);
 

diff --git a/options.c b/options.c
index ede7cda6f018f614374184b9b31a570294fbfa95..cb8182de93c259a8ef2f3bc9141aa9795b2bbda4 100644 (file)
--- a/options.c
+++ b/options.c
@@ -8,6 +8,7 @@
 #include <fcntl.h>
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <netinet/in.h>
 
 #include "fio.h"
 #include "verify.h"
@@ -17,7 +18,7 @@
 
 #include "crc/crc32c.h"
 
-char client_sockaddr_str[INET6_ADDRSTRLEN] = {0};
+char client_sockaddr_str[INET6_ADDRSTRLEN] = { 0 };
 
 /*
  * Check if mmap/mmaphuge has a :/foo/bar/file at the end. If so, return that.
@@ -822,7 +823,7 @@ static int get_max_name_idx(char *input)
  * Returns the directory at the index, indexes > entires will be
  * assigned via modulo division of the index
  */
-int set_name_idx(char *target, char *input, int index)
+int set_name_idx(char *target, size_t tlen, char *input, int index)
 {
        unsigned int cur_idx;
        int len;
@@ -835,11 +836,12 @@ int set_name_idx(char *target, char *input, int index)
                fname = get_next_name(&str);
 
        if (client_sockaddr_str[0]) {
-               len = sprintf(target, "%s/%s.", fname, client_sockaddr_str);
-       } else {
-               len = sprintf(target, "%s/", fname);
-       }
+               len = snprintf(target, tlen, "%s/%s.", fname,
+                               client_sockaddr_str);
+       } else
+               len = snprintf(target, tlen, "%s/", fname);
 
+       target[tlen - 1] = '\0';
        free(p);
 
        return len;

diff --git a/options.h b/options.h
index bd97654b57e38cf05e85c53fe006c154f51f21e3..6805b314125a96778e44e8d222720b1346ff651b 100644 (file)
--- a/options.h
+++ b/options.h
@@ -6,7 +6,6 @@
 #include <string.h>
 #include "parse.h"
 #include "flist.h"
-#include "client.h"
 
 #define td_var_offset(var)     ((size_t) &((struct thread_options *)0)->var)
 
@@ -19,9 +18,9 @@ void del_opt_posval(const char *, const char *);
 struct thread_data;
 void fio_options_free(struct thread_data *);
 char *get_name_idx(char *, int);
-int set_name_idx(char *, char *, int);
+int set_name_idx(char *, size_t, char *, int);
 
-extern char client_sockaddr_str[INET6_ADDRSTRLEN];  /* used with --client option */
+extern char client_sockaddr_str[];  /* used with --client option */
 
 extern struct fio_option fio_options[FIO_MAX_OPTS];