blkverify: Catch bs->exact_filename overflow

XanClic · XanClic · commit 05cc758a3dfc · 2017-06-26T14:54:46.000+02:00
The bs-&gt;exact_filename field may not be sufficient to store the full
blkverify node filename. In this case, we should not generate a filename
at all instead of an unusable one.

Cc: qemu-stable@nongnu.org
Reported-by: Qu Wenruo &lt;quwenruo@cn.fujitsu.com&gt;
Signed-off-by: Max Reitz &lt;mreitz@redhat.com&gt;
Message-id: 20170613172006.19685-3-mreitz@redhat.com
Reviewed-by: Alberto Garcia &lt;berto@igalia.com&gt;
Reviewed-by: Stefan Hajnoczi &lt;stefanha@redhat.com&gt;
Signed-off-by: Max Reitz &lt;mreitz@redhat.com&gt;
diff --git a/block/blkverify.c b/block/blkverify.c
@@ -301,10 +301,14 @@ static void blkverify_refresh_filename(BlockDriverState *bs, QDict *options)
     if (bs->file->bs->exact_filename[0]
         && s->test_file->bs->exact_filename[0])
     {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "blkverify:%s:%s",
-                 bs->file->bs->exact_filename,
-                 s->test_file->bs->exact_filename);
+        int ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                           "blkverify:%s:%s",
+                           bs->file->bs->exact_filename,
+                           s->test_file->bs->exact_filename);
+        if (ret >= sizeof(bs->exact_filename)) {
+            /* An overflow makes the filename unusable, so do not report any */
+            bs->exact_filename[0] = 0;
+        }
     }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -301,10 +301,14 @@ static void blkverify_refresh_filename(BlockDriverState bs, QDict options)`
`301`	`301`	`if (bs->file->bs->exact_filename[0]`
`302`	`302`	`&& s->test_file->bs->exact_filename[0])`
`303`	`303`	`{`
`304`		`- snprintf(bs->exact_filename, sizeof(bs->exact_filename),`
`305`		`- "blkverify:%s:%s",`
`306`		`- bs->file->bs->exact_filename,`
`307`		`- s->test_file->bs->exact_filename);`
	`304`	`+ int ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename),`
	`305`	`+ "blkverify:%s:%s",`
	`306`	`+ bs->file->bs->exact_filename,`
	`307`	`+ s->test_file->bs->exact_filename);`
	`308`	`+ if (ret >= sizeof(bs->exact_filename)) {`
	`309`	`+ /* An overflow makes the filename unusable, so do not report any */`
	`310`	`+ bs->exact_filename[0] = 0;`
	`311`	`+ }`
`308`	`312`	`}`
`309`	`313`	`}`
`310`	`314`