From: Jens Axboe <axboe@kernel.dk>
Date: Sat, 16 Jan 2021 20:36:27 +0000 (-0700)
Subject: Merge branch 'fix_filename_overrun' of https://github.com/sitsofe/fio
X-Git-Tag: fio-3.26~60
X-Git-Url: https://git.kernel.dk/?p=fio.git;a=commitdiff_plain;h=548b363c08875165a018788195e8fd2304c2ce24;hp=90711edc3d0fb70fd94104831d7bb305780b8619

Merge branch 'fix_filename_overrun' of https://github.com/sitsofe/fio

* 'fix_filename_overrun' of https://github.com/sitsofe/fio:
  options: fix buffer overrun
---

diff --git a/options.c b/options.c
index 0b4c48d6..955bf959 100644
--- a/options.c
+++ b/options.c
@@ -1672,6 +1672,7 @@ struct fio_option fio_options[FIO_MAX_OPTS] = {
 		.lname	= "Filename(s)",
 		.type	= FIO_OPT_STR_STORE,
 		.off1	= offsetof(struct thread_options, filename),
+		.maxlen	= PATH_MAX,
 		.cb	= str_filename_cb,
 		.prio	= -1, /* must come after "directory" */
 		.help	= "File(s) to use for the workload",
diff --git a/parse.c b/parse.c
index c28d82ef..44bf9507 100644
--- a/parse.c
+++ b/parse.c
@@ -786,6 +786,11 @@ static int __handle_option(const struct fio_option *o, const char *ptr,
 		if (o->off1) {
 			cp = td_var(data, o, o->off1);
 			*cp = strdup(ptr);
+			if (strlen(ptr) > o->maxlen - 1) {
+				log_err("value exceeds max length of %d\n",
+					o->maxlen);
+				return 1;
+			}
 		}
 
 		if (fn)