util: CID 1499409: Memory - corruptions (OVERLAPPING_COPY)

This is quite bizarre:

*** CID 1499409:  Memory - corruptions  (OVERLAPPING_COPY)
/lib/util/debug.c: 1742 in dbghdrclass()
1736     					 sizeof(tvbuf.buf),
1737     					 "%ld seconds since the Epoch", (long)t);
1738     			}
1739     		}
1740
1741     		ensure_hostname();
>>>     CID 1499409:  Memory - corruptions  (OVERLAPPING_COPY)
>>>     In the call to function "snprintf", the object pointed to by argument "state.hostname" may overlap with the object pointed to by argument "state.header_str".
1742     		state.hs_len = snprintf(state.header_str,
1743     					sizeof(state.header_str),
1744     					"%s %s %s[%u]: ",
1745     					tvbuf.buf,
1746     					state.hostname,
1747     					state.prog_name,

Coverity doesn't explicitly say so but the only way this can happen is
if state.hostname is not NUL-terminated within its declared length.
ensure_hostname() and debug_set_hostname() ensure NUL-termination, but
the caching effect of ensure_hostname() probably stops Coverity from
being certain about anything.

Try making Coverity happy by using a precision to limit the number of
characters from hostname that can be used.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Feb 22 00:17:12 UTC 2022 on sn-devel-184

diff --git a/lib/util/debug.c b/lib/util/debug.c
index 784357e937058eab8eb1d9ba86cc4eb2562845c1..4143cb6058afc18c36f67ad1cc2601605ac268f3 100644 (file)
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -1741,8 +1741,9 @@ bool dbghdrclass(int level, int cls, const char *location, const char *func)
                ensure_hostname();
                state.hs_len = snprintf(state.header_str,
                                        sizeof(state.header_str),
-                                       "%s %s %s[%u]: ",
+                                       "%s %.*s %s[%u]: ",
                                        tvbuf.buf,
+                                       (int)(sizeof(state.hostname) - 1),
                                        state.hostname,
                                        state.prog_name,
                                        (unsigned int) getpid());