diff mbox

[ndctl,1/4] libndctl: fix potential buffer overflow in write_cache APIs

Message ID 20180503185050.7559-1-vishal.l.verma@intel.com (mailing list archive)
State New, archived
Headers show

Commit Message

Verma, Vishal L May 3, 2018, 6:50 p.m. UTC 
We used a local stack variable to hold the sysfs path, which had a
potential to overflow. Instead, switch to the 'scratch space' bdbs->buf
to store the sysfs path as it is correctly sized for it.

Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
---
 ndctl/lib/libndctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/ndctl/lib/libndctl.c b/ndctl/lib/libndctl.c
index 59ea82a..2a3ef0c 100644
--- a/ndctl/lib/libndctl.c
+++ b/ndctl/lib/libndctl.c
@@ -3991,10 +3991,10 @@  static int __ndctl_namespace_set_write_cache(struct ndctl_namespace *ndns,
 {
 	struct ndctl_ctx *ctx = ndctl_namespace_get_ctx(ndns);
 	struct ndctl_pfn *pfn = ndctl_namespace_get_pfn(ndns);
+	char *path = ndns->ndns_buf;
 	char buf[SYSFS_ATTR_SIZE];
 	int len = ndns->buf_len;
 	const char *bdev;
-	char path[50];
 
 	if (state != 1 && state != 0)
 		return -ENXIO;
@@ -4034,9 +4034,9 @@  NDCTL_EXPORT int ndctl_namespace_write_cache_is_enabled(
 	struct ndctl_ctx *ctx = ndctl_namespace_get_ctx(ndns);
 	struct ndctl_pfn *pfn = ndctl_namespace_get_pfn(ndns);
 	int len = ndns->buf_len, wc;
+	char *path = ndns->ndns_buf;
 	char buf[SYSFS_ATTR_SIZE];
 	const char *bdev;
-	char path[50];
 
 	if (pfn)
 		bdev = ndctl_pfn_get_block_device(pfn);