From: Ken Raeburn <raeburn@permabit.com>
Date: Tue, 29 Jan 2013 09:18:13 +0000 (+0100)
Subject: Fix crash with absurdly but not impossibly deeply nested device stacks
X-Git-Tag: fio-2.0.14~66
X-Git-Url: https://git.kernel.dk/?p=fio.git;a=commitdiff_plain;h=4b919f7740f4875d73c0619a08d269d5c679e19f

Fix crash with absurdly but not impossibly deeply nested device stacks

Use the proper PATH_MAX for the max path for disk util, and use
snprintf() to avoid potentially overwriting it.

Modified by Jens to return NULL instead of exiting.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/diskutil.c b/diskutil.c
index fbc4268e..3681dde5 100644
--- a/diskutil.c
+++ b/diskutil.c
@@ -276,13 +276,20 @@ static struct disk_util *disk_util_add(struct thread_data *td, int majdev,
 {
 	struct disk_util *du, *__du;
 	struct flist_head *entry;
+	int l;
 
 	dprint(FD_DISKUTIL, "add maj/min %d/%d: %s\n", majdev, mindev, path);
 
 	du = smalloc(sizeof(*du));
 	memset(du, 0, sizeof(*du));
 	INIT_FLIST_HEAD(&du->list);
-	sprintf(du->path, "%s/stat", path);
+	l = snprintf(du->path, sizeof(du->path), "%s/stat", path);
+	if (l < 0 || l >= sizeof(du->path)) {
+		log_err("constructed path \"%.100s[...]/stat\" larger than buffer (%zu bytes)\n",
+			path, sizeof(du->path) - 1);
+		sfree(du);
+		return NULL;
+	}
 	strncpy((char *) du->dus.name, basename(path), FIO_DU_NAME_SZ);
 	du->sysfs_root = path;
 	du->major = majdev;
diff --git a/diskutil.h b/diskutil.h
index b89aaccb..ddd64719 100644
--- a/diskutil.h
+++ b/diskutil.h
@@ -42,7 +42,7 @@ struct disk_util {
 
 	char *name;
 	char *sysfs_root;
-	char path[256];
+	char path[PATH_MAX];
 	int major, minor;
 
 	struct disk_util_stat dus;