From: Martin Schwenke Date: Fri, 18 Feb 2022 01:02:50 +0000 (+1100) Subject: util: CID 1499409: Memory - corruptions (OVERLAPPING_COPY) X-Git-Tag: tevent-0.12.0~674 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a2590298b035404d507fac1ea0e11dcd88a939fa;p=thirdparty%2Fsamba.git util: CID 1499409: Memory - corruptions (OVERLAPPING_COPY) This is quite bizarre: *** CID 1499409: Memory - corruptions (OVERLAPPING_COPY) /lib/util/debug.c: 1742 in dbghdrclass() 1736 sizeof(tvbuf.buf), 1737 "%ld seconds since the Epoch", (long)t); 1738 } 1739 } 1740 1741 ensure_hostname(); >>> CID 1499409: Memory - corruptions (OVERLAPPING_COPY) >>> In the call to function "snprintf", the object pointed to by argument "state.hostname" may overlap with the object pointed to by argument "state.header_str". 1742 state.hs_len = snprintf(state.header_str, 1743 sizeof(state.header_str), 1744 "%s %s %s[%u]: ", 1745 tvbuf.buf, 1746 state.hostname, 1747 state.prog_name, Coverity doesn't explicitly say so but the only way this can happen is if state.hostname is not NUL-terminated within its declared length. ensure_hostname() and debug_set_hostname() ensure NUL-termination, but the caching effect of ensure_hostname() probably stops Coverity from being certain about anything. Try making Coverity happy by using a precision to limit the number of characters from hostname that can be used. Signed-off-by: Martin Schwenke Reviewed-by: Andreas Schneider Reviewed-by: Andrew Bartlett Autobuild-User(master): Martin Schwenke Autobuild-Date(master): Tue Feb 22 00:17:12 UTC 2022 on sn-devel-184 --- diff --git a/lib/util/debug.c b/lib/util/debug.c index 784357e9370..4143cb6058a 100644 --- a/lib/util/debug.c +++ b/lib/util/debug.c @@ -1741,8 +1741,9 @@ bool dbghdrclass(int level, int cls, const char *location, const char *func) ensure_hostname(); state.hs_len = snprintf(state.header_str, sizeof(state.header_str), - "%s %s %s[%u]: ", + "%s %.*s %s[%u]: ", tvbuf.buf, + (int)(sizeof(state.hostname) - 1), state.hostname, state.prog_name, (unsigned int) getpid());