From: Darrick J. Wong <darrick.wong@oracle.com>
Date: Fri, 18 Jul 2014 22:54:07 +0000 (-0700)
Subject: misc: fix problems with strncat
X-Git-Tag: v1.42.12~72
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c3470fcd60be3b47f077dbddf6c6e7246903c27b;p=thirdparty%2Fe2fsprogs.git

misc: fix problems with strncat

The third argument to strncat is the maximum number of characters to
copy out of the second argument; it is not the maximum length of the
first argument.

Therefore, code in a check just in case we ever find a /sys/block/X
path long enough to hit the end of the buffer.  FWIW the longest path
I could find on my machine was 133 bytes.

Fixes-Coverity-Bug: 1252003
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---

diff --git a/misc/mk_hugefiles.c b/misc/mk_hugefiles.c
index 41280f08e..6bc25e629 100644
--- a/misc/mk_hugefiles.c
+++ b/misc/mk_hugefiles.c
@@ -188,7 +188,9 @@ static blk64_t get_partition_start(const char *device_name)
 	cp = search_sysfs_block(st.st_rdev, path);
 	if (!cp)
 		return 0;
-	strncat(path, "/start", SYSFS_PATH_LEN-1);
+	if (strlen(path) > SYSFS_PATH_LEN - sizeof("/start"))
+		return 0;
+	strcat(path, "/start");
 	f = fopen(path, "r");
 	if (!f)
 		return 0;