[PATCH 13/68] test-dump-cache-tree: avoid overflow of cache-tree name
- From
Jeff King <peff@peff.net>
- Date
- Sep 24, 2015, 21:06 UTC
- Message-ID
- <20150924210603.GJ30946@sigill.intra.peff.net>
- In-Reply-To
- <20150924210225.GA23624@sigill.intra.peff.net>
When dumping a cache-tree, we sprintf sub-tree names directly into a fixed-size buffer, which can overflow. We can trivially fix this by converting to xsnprintf to at least notice and die.
This probably should handle arbitrary-sized names, but there's not much point. It's used only by the test scripts, so the trivial fix is enough.
Signed-off-by: Jeff King <peff@peff.net> --- test-dump-cache-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/test-dump-cache-tree.c b/test-dump-cache-tree.c index 54c0872..bb53c0a 100644 --- a/test-dump-cache-tree.c +++ b/test-dump-cache-tree.c @@ -47,7 +47,7 @@ static int dump_cache_tree(struct cache_tree *it, struct cache_tree_sub *rdwn; rdwn = cache_tree_sub(ref, down->name); - sprintf(path, "%s%.*s/", pfx, down->namelen, down->name); + xsnprintf(path, sizeof(path), "%s%.*s/", pfx, down->namelen, down->name); if (dump_cache_tree(down->cache_tree, rdwn->cache_tree, path)) errs = 1; }
-- 2.6.0.rc3.454.g204ad51