From: Jens Axboe <axboe@fb.com>
Date: Mon, 14 Apr 2014 14:43:55 +0000 (-0600)
Subject: verify: fix potential buffer overrun in dump_buf()
X-Git-Tag: fio-2.1.9~60
X-Git-Url: https://git.kernel.dk/?p=fio.git;a=commitdiff_plain;h=dacbbb8875c09e982d59e1c1a40879af81842a42

verify: fix potential buffer overrun in dump_buf()

Signed-off-by: Jens Axboe <axboe@fb.com>
---

diff --git a/verify.c b/verify.c
index 9eb532a2..282a8cf9 100644
--- a/verify.c
+++ b/verify.c
@@ -226,16 +226,32 @@ struct vcont {
 	unsigned int crc_len;
 };
 
+#define DUMP_BUF_SZ	255
+static int dump_buf_warned;
+
 static void dump_buf(char *buf, unsigned int len, unsigned long long offset,
 		     const char *type, struct fio_file *f)
 {
-	char *ptr, fname[256];
+	char *ptr, fname[DUMP_BUF_SZ];
+	size_t buf_left = DUMP_BUF_SZ;
 	int ret, fd;
 
 	ptr = strdup(f->file_name);
-	strcpy(fname, basename(ptr));
 
-	sprintf(fname + strlen(fname), ".%llu.%s", offset, type);
+	fname[DUMP_BUF_SZ - 1] = '\0';
+	strncpy(fname, basename(ptr), DUMP_BUF_SZ - 1);
+
+	buf_left -= strlen(fname);
+	if (buf_left <= 0) {
+		if (!dump_buf_warned) {
+			log_err("fio: verify failure dump buffer too small\n");
+			dump_buf_warned = 1;
+		}
+		free(ptr);
+		return;
+	}
+
+	snprintf(fname + strlen(fname), buf_left, ".%llu.%s", offset, type);
 
 	fd = open(fname, O_CREAT | O_TRUNC | O_WRONLY, 0644);
 	if (fd < 0) {