On Wed, 2008-10-22 at 23:40 +0200, Daniel Gollub wrote:
> Hi,
>
> please find attached a fix for potential overflows in sched_tc4 and
> sched_driver.
>
> sched_tc4:
> RAWDEV could be much large then 16 chars - e.g. /dev/cciss/c0d0p6 (18)
> (only use of RAWDEV in entire sched_stress module)
>
> sched_driver:
> pathname could be much large then 50 - increased to PATH_MAX.
>
> Problem observed and original fixed by Yi Xu.
> Patch got slightly cleaned-up/modified.
>
> Reviewed-by: Daniel Gollub <[EMAIL PROTECTED]>
> Signed-off-by: Daniel Gollub <[EMAIL PROTECTED]>
Thanks.
Regards--
Subrata
>
> ---
> testcases/kernel/sched/sched_stress/sched_driver.c | 3 ++-
> testcases/kernel/sched/sched_stress/sched_tc4.c | 8 +++-----
> 2 files changed, 5 insertions(+), 6 deletions(-)
>
> Index: testcases/kernel/sched/sched_stress/sched_driver.c
> ===================================================================
> --- testcases/kernel/sched/sched_stress/sched_driver.c.orig
> +++ testcases/kernel/sched/sched_stress/sched_driver.c
> @@ -69,6 +69,7 @@
> #include <signal.h>
> #include <pwd.h>
> #include <time.h>
> +#include <limits.h>
> #include "sched.h"
>
> /*
> @@ -421,7 +422,7 @@ char *name, /* filename of testcase
> *param3; /* if sched_tc6: fork flag, 0=false, 1=true */
> float *t2; /* if sched_tc6: second time returned from testcase */
> {
> - char temp[50], /* holds pathname and returned floating number
> */
> + char temp[PATH_MAX], /* holds pathname and returned floating number
> */
> t2asc[50]; /* holds second returned floating number */
> int saved_pid; /* process id of forked process */
> FILE *datafile; /* file pointer for temporary file */
> Index: testcases/kernel/sched/sched_stress/sched_tc4.c
> ===================================================================
> --- testcases/kernel/sched/sched_stress/sched_tc4.c.orig
> +++ testcases/kernel/sched/sched_stress/sched_tc4.c
> @@ -189,13 +189,11 @@ void read_raw_device()
> int i; /* loop counter */
> int blocks=0; /* number of blocks read */
> #ifndef __linux__
> - static char raw_dev[16] = "/dev/hd2"; /* name of raw device file */
> + char raw_dev[50] = "/dev/hd2"; /* name of raw device file */
> #else
> - static char raw_dev[16]; /* name of raw device file */
> + char *raw_dev; /* name of raw device file */
>
> - if (getenv("RAWDEV"))
> - sprintf(raw_dev, "%s", getenv("RAWDEV"));
> - else
> + if ((raw_dev = getenv("RAWDEV")) == NULL)
> {
> errno = ENODATA;
> sys_error("environment variable RAWDEV not set", __FILE__,__LINE__);
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ltp-list mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ltp-list
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ltp-list mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ltp-list
