Chen Gang <gang.chen.5...@gmail.com> writes:
> 'ctx->fs_root' + 'path'/'fullname.data' may be larger than PATH_MAX, so
> need use snprintf() instead of sprintf() just like another area have done in
> 9pfs.
>
> Signed-off-by: Chen Gang <gang.chen.5...@gmail.com>
> ---
> hw/9pfs/virtio-9p-local.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/hw/9pfs/virtio-9p-local.c b/hw/9pfs/virtio-9p-local.c
> index 77a04cd..61be75a 100644
> --- a/hw/9pfs/virtio-9p-local.c
> +++ b/hw/9pfs/virtio-9p-local.c
> @@ -898,7 +898,8 @@ static int local_remove(FsContext *ctx, const char *path)
> * directory
> */
> if (S_ISDIR(stbuf.st_mode)) {
> - sprintf(buffer, "%s/%s/%s", ctx->fs_root, path, VIRTFS_META_DIR);
> + snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s",
> + ctx->fs_root, path, VIRTFS_META_DIR);
> err = remove(buffer);
> if (err < 0 && errno != ENOENT) {
> /*
> @@ -1033,8 +1034,8 @@ static int local_unlinkat(FsContext *ctx, V9fsPath *dir,
> * If directory remove .virtfs_metadata contained in the
> * directory
> */
> - sprintf(buffer, "%s/%s/%s", ctx->fs_root,
> - fullname.data, VIRTFS_META_DIR);
> + snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s", ctx->fs_root,
> + fullname.data, VIRTFS_META_DIR);
> ret = remove(buffer);
> if (ret < 0 && errno != ENOENT) {
> /*
Turns a buffer overrun bug into a truncation bug. The next commit fixes
truncation bugs including this one. Would be nice to spell this out in
the commit message. Perhaps Aneesh can do it on commit.
