From 17a2be5945b12959ad3066b7d75432577d29ae82 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Sun, 4 Jan 2015 13:33:37 -0700 Subject: [PATCH] Avoid potential buffer overflow in make_filename() Signed-off-by: Jens Axboe --- init.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/init.c b/init.c index dc563fd2..a0d4f8c7 100644 --- a/init.c +++ b/init.c @@ -1036,8 +1036,14 @@ static char *make_filename(char *buf, size_t buf_size,struct thread_options *o, ret = snprintf(dst, dst_left, "%s", jobname); if (ret < 0) break; - dst += ret; - dst_left -= ret; + else if (ret > dst_left) { + log_err("fio: truncated filename\n"); + dst += dst_left; + dst_left = 0; + } else { + dst += ret; + dst_left -= ret; + } break; } case FPRE_JOBNUM: { @@ -1046,8 +1052,14 @@ static char *make_filename(char *buf, size_t buf_size,struct thread_options *o, ret = snprintf(dst, dst_left, "%d", jobnum); if (ret < 0) break; - dst += ret; - dst_left -= ret; + else if (ret > dst_left) { + log_err("fio: truncated filename\n"); + dst += dst_left; + dst_left = 0; + } else { + dst += ret; + dst_left -= ret; + } break; } case FPRE_FILENUM: { @@ -1056,8 +1068,14 @@ static char *make_filename(char *buf, size_t buf_size,struct thread_options *o, ret = snprintf(dst, dst_left, "%d", filenum); if (ret < 0) break; - dst += ret; - dst_left -= ret; + else if (ret > dst_left) { + log_err("fio: truncated filename\n"); + dst += dst_left; + dst_left = 0; + } else { + dst += ret; + dst_left -= ret; + } break; } default: -- 2.25.1