From: Jens Axboe <axboe@fb.com>
Date: Thu, 7 May 2015 14:17:05 +0000 (-0600)
Subject: Ensure that set_name_idx() doesn't exceed target bounds
X-Git-Tag: fio-2.2.8~9
X-Git-Url: https://git.kernel.dk/?p=fio.git;a=commitdiff_plain;h=e13c3b50a1aa156223b5b9d20ed3d38dd4292479

Ensure that set_name_idx() doesn't exceed target bounds

Signed-off-by: Jens Axboe <axboe@fb.com>
---

diff --git a/filesetup.c b/filesetup.c
index 10fc4150..aee7ece9 100644
--- a/filesetup.c
+++ b/filesetup.c
@@ -1262,7 +1262,7 @@ int add_file(struct thread_data *td, const char *fname, int numjob, int inc)
 	dprint(FD_FILE, "add file %s\n", fname);
 
 	if (td->o.directory)
-		len = set_name_idx(file_name, td->o.directory, numjob);
+		len = set_name_idx(file_name, PATH_MAX, td->o.directory, numjob);
 
 	sprintf(file_name + len, "%s", fname);
 
diff --git a/options.c b/options.c
index ede7cda6..cb8182de 100644
--- a/options.c
+++ b/options.c
@@ -8,6 +8,7 @@
 #include <fcntl.h>
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <netinet/in.h>
 
 #include "fio.h"
 #include "verify.h"
@@ -17,7 +18,7 @@
 
 #include "crc/crc32c.h"
 
-char client_sockaddr_str[INET6_ADDRSTRLEN] = {0};
+char client_sockaddr_str[INET6_ADDRSTRLEN] = { 0 };
 
 /*
  * Check if mmap/mmaphuge has a :/foo/bar/file at the end. If so, return that.
@@ -822,7 +823,7 @@ static int get_max_name_idx(char *input)
  * Returns the directory at the index, indexes > entires will be
  * assigned via modulo division of the index
  */
-int set_name_idx(char *target, char *input, int index)
+int set_name_idx(char *target, size_t tlen, char *input, int index)
 {
 	unsigned int cur_idx;
 	int len;
@@ -835,11 +836,12 @@ int set_name_idx(char *target, char *input, int index)
 		fname = get_next_name(&str);
 
 	if (client_sockaddr_str[0]) {
-		len = sprintf(target, "%s/%s.", fname, client_sockaddr_str);
-	} else {
-		len = sprintf(target, "%s/", fname);
-	}
+		len = snprintf(target, tlen, "%s/%s.", fname,
+				client_sockaddr_str);
+	} else
+		len = snprintf(target, tlen, "%s/", fname);
 
+	target[tlen - 1] = '\0';
 	free(p);
 
 	return len;
diff --git a/options.h b/options.h
index bd97654b..6805b314 100644
--- a/options.h
+++ b/options.h
@@ -6,7 +6,6 @@
 #include <string.h>
 #include "parse.h"
 #include "flist.h"
-#include "client.h"
 
 #define td_var_offset(var)	((size_t) &((struct thread_options *)0)->var)
 
@@ -19,9 +18,9 @@ void del_opt_posval(const char *, const char *);
 struct thread_data;
 void fio_options_free(struct thread_data *);
 char *get_name_idx(char *, int);
-int set_name_idx(char *, char *, int);
+int set_name_idx(char *, size_t, char *, int);
 
-extern char client_sockaddr_str[INET6_ADDRSTRLEN];  /* used with --client option */
+extern char client_sockaddr_str[];  /* used with --client option */
 
 extern struct fio_option fio_options[FIO_MAX_OPTS];