In the iet and datacore prioritizers, multipath was using sscanf to get a string for a 255 byte buffer, without limiting the size of the string. This could result in a buffer overflow, if there was a bad value in multipath.conf.
Signed-off-by: Benjamin Marzinski <[email protected]> --- Note: This patch applies on top of Martin's ("libmultipath: iet prioritizer: obtain PATH_ID from udev") commit, from the "tip" branch. libmultipath/prioritizers/datacore.c | 6 +++--- libmultipath/prioritizers/iet.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/libmultipath/prioritizers/datacore.c b/libmultipath/prioritizers/datacore.c index ab813a0e..a7c2ae3e 100644 --- a/libmultipath/prioritizers/datacore.c +++ b/libmultipath/prioritizers/datacore.c @@ -49,11 +49,11 @@ int datacore_prio (const char *dev, int sg_fd, char * args, return 0; } - if (sscanf(args, "timeout=%i preferredsds=%s", + if (sscanf(args, "timeout=%i preferredsds=%254s", (int *)&timeout_ms, preferredsds) == 2) {} - else if (sscanf(args, "preferredsds=%s timeout=%i", + else if (sscanf(args, "preferredsds=%254s timeout=%i", preferredsds, (int *)&timeout_ms) == 2) {} - else if (sscanf(args, "preferredsds=%s", + else if (sscanf(args, "preferredsds=%254s", preferredsds) == 1) {} else { dc_log(0, "unexpected prio_args format"); diff --git a/libmultipath/prioritizers/iet.c b/libmultipath/prioritizers/iet.c index 97d35192..cddf29c6 100644 --- a/libmultipath/prioritizers/iet.c +++ b/libmultipath/prioritizers/iet.c @@ -101,7 +101,7 @@ int iet_prio(struct udev_device *udev, char *args) return 0; } // check if args format is OK - if (sscanf(args, "preferredip=%s", preferredip) != 1) { + if (sscanf(args, "preferredip=%254s", preferredip) != 1) { if (!arg_logged) { dc_log(2, "unexpected prio_args format"); arg_logged = true; -- 2.53.0
