itri-sofa / sofa

SOFA (Software Orchestrated Flash Array) is a log-structured flash array management system
Apache License 2.0
41 stars 11 forks source link

Eliminate the use of dangerous fgets() #7

Open jserv opened 4 years ago

jserv commented 4 years ago

Reported by Cppcheck:

[src/common/sofa_config.c:972]: (error) Buffer is accessed out of bounds: osdisk_name

The corresponding code:

    if (fgets(osdisk_name, CFG_VALSET_STR_LEN, fp) != NULL) {
        if (osdisk_name[0] != 0) {
            _remove_char_str(osdisk_name, strlen(osdisk_name), '\n');
            set_config_item(STR_OSDISK_NAME, osdisk_name, NULL);
            strcpy(osdisk_ret, osdisk_name);
            syslog(LOG_INFO, "[SOFA] USERD INFO get os disk: %s\n",
                   osdisk_name);
            ret = 0;
        } else {

Quoted from Deprecated string input functions - fget:

The fgets ("file get string") function is similar to the gets function. This function is deprecated -- that means it is obsolete and it is strongly suggested you do not use it -- because it is dangerous. It is dangerous because if the input data contains a null character, you can't tell. Don't use fgets unless you know the data cannot contain a null. Don't use it to read files edited by the user because, if the user inserts a null character, you should either handle it properly or print a clear error message. Always use getline or getdelim instead of fgets if you can.

peter-huang0402 commented 4 years ago

Thank you for your suggestions. Later we will review our codes and replace fgets() with getline() or getdelim() instead.