From: Kamalesh Babulal Date: Mon, 8 Aug 2022 16:36:16 +0000 (-0600) Subject: api.c: add precision to fscanf(), in cgroup_get_all_controller_next() X-Git-Tag: v2.0.3~22 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=97aa5a67f9ed067a281cb77a06546ab09191064c;p=thirdparty%2Flibcgroup.git api.c: add precision to fscanf(), in cgroup_get_all_controller_next() Fix calling risky function warning, reported by Coverity tool: CID 258300 (#1 of 1): Calling risky function (DC.STREAM_BUFFER)dont_call: fscanf assumes an arbitrarily long string, so callers must use correct precision specifiers or never use fscanf. As per secure coding standard, using '%s' in the fscanf() is not recommend, hence fix it by using the precision of macro MAX_CGROUP_TYPE_NAMELEN borrowed from Linux Kernel for the maximum allowed controller/subsys_name length. Signed-off-by: Kamalesh Babulal Signed-off-by: Tom Hromatka (cherry picked from commit 4036f4fe4334572a4669dfece01ff24dbdd56477) --- diff --git a/src/api.c b/src/api.c index 280eebf7..6515142a 100644 --- a/src/api.c +++ b/src/api.c @@ -5487,7 +5487,11 @@ int cgroup_get_all_controller_next(void **handle, struct controller_data *info) if (!info) return ECGINVAL; - err = fscanf(proc_cgroup, "%s %d %d %d\n", subsys_name, + /* + * check Linux Kernel sources/kernel/cgroup/cgroup.c cgroup_init_early(), + * MAX_CGROUP_TYPE_NAMELEN check for details on why 32 is used. + */ + err = fscanf(proc_cgroup, "%32s %d %d %d\n", subsys_name, &hierarchy, &num_cgroups, &enabled); if (err != 4)