verify: verify_state_gen_name() should check size

Signed-off-by: Jens Axboe <axboe@fb.com>

diff --git a/server.c b/server.c
index a8d4868fa1f30e75d2d4e42a6b2f1eeba9ee0c8d..c4ab906f74f38e579ee7eb3d838f95abbdef0fc5 100644 (file)
--- a/server.c
+++ b/server.c
@@ -1391,7 +1391,8 @@ int fio_server_get_verify_state(const char *name, int threadnumber,
        rep->data = NULL;
        rep->error = 0;
 
        rep->data = NULL;
        rep->error = 0;
 

-       verify_state_gen_name((char *) out.path, name, me, threadnumber);
+       verify_state_gen_name((char *) out.path, sizeof(out.path), name, me,
+                               threadnumber);

        tag = (uint64_t) (uintptr_t) rep;
        fio_net_send_cmd(server_fd, FIO_NET_CMD_SENDFILE, &out, sizeof(out),
                                &tag, NULL);
        tag = (uint64_t) (uintptr_t) rep;
        fio_net_send_cmd(server_fd, FIO_NET_CMD_SENDFILE, &out, sizeof(out),
                                &tag, NULL);

diff --git a/verify.c b/verify.c
index a0c2e38ad170cee6cc21929186a26e8d941e60b7..f05e85dfb0475c837f5f826adbd0283af63c3d49 100644 (file)
--- a/verify.c
+++ b/verify.c
@@ -1375,7 +1375,7 @@ static int open_state_file(const char *name, const char *prefix, int num,
        else
                flags = O_RDONLY;
 
        else
                flags = O_RDONLY;
 

-       verify_state_gen_name(out, name, prefix, num);
+       verify_state_gen_name(out, sizeof(out), name, prefix, num);

 
        fd = open(out, flags, 0644);
        if (fd == -1) {
 
        fd = open(out, flags, 0644);
        if (fd == -1) {

diff --git a/verify.h b/verify.h
index 3e52f9c1872974599c0e541955caacc83a12d3b5..43de887d0b3004a26b137e3f74910b17c0419626 100644 (file)
--- a/verify.h
+++ b/verify.h
@@ -138,10 +138,12 @@ static inline struct thread_io_list *io_list_next(struct thread_io_list *s)
        return (void *) s + thread_io_list_sz(s);
 }
 
        return (void *) s + thread_io_list_sz(s);
 }
 

-static inline void verify_state_gen_name(char *out, const char *name,
-                                        const char *prefix, int num)
+static inline void verify_state_gen_name(char *out, size_t size,
+                                        const char *name, const char *prefix,
+                                        int num)

 {
 {

-       sprintf(out, "%s-%s-%d-verify.state", prefix, name, num);
+       snprintf(out, size, "%s-%s-%d-verify.state", prefix, name, num);
+       out[size - 1] = '\0';

 }
 
 #endif
 }
 
 #endif