From 7d0c5e24a5b2425abcfb778f9c31db39f53703c8 Mon Sep 17 00:00:00 2001 From: Lukasz Dorau Date: Wed, 19 Oct 2011 11:51:48 +0200 Subject: [PATCH] imsm: fix: prevent segfault in mark_failure Using an array of chars without the terminating null byte as a parameter of sprintf() function causes segfault when dealing with SAS drives (with 20-digits serial number). The memcpy() function is used instead. Signed-off-by: Lukasz Dorau Signed-off-by: NeilBrown --- super-intel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/super-intel.c b/super-intel.c index 401c701f..2c1bf058 100644 --- a/super-intel.c +++ b/super-intel.c @@ -6015,7 +6015,9 @@ static int mark_failure(struct imsm_dev *dev, struct imsm_disk *disk, int idx) if (is_failed(disk) && (ord & IMSM_ORD_REBUILD)) return 0; - sprintf(buf, "%s:0", disk->serial); + memcpy(buf, disk->serial, MAX_RAID_SERIAL_LEN); + buf[MAX_RAID_SERIAL_LEN] = '\000'; + strcat(buf, ":0"); if ((len = strlen(buf)) >= MAX_RAID_SERIAL_LEN) shift = len - MAX_RAID_SERIAL_LEN + 1; strncpy((char *)disk->serial, &buf[shift], MAX_RAID_SERIAL_LEN); -- 2.39.2