ublk-org / ublksrv

ublk: userspace block device driver
MIT License
147 stars 50 forks source link

ublksrv_tgt: fix potential buffer overflow when printing usage in help #19

Closed yhr closed 2 years ago

yhr commented 2 years ago

Hi Ming, thanks for a great project!

After figuring out how to build on my (outdated) ubuntu-box

export PTHREAD_LIBS="-lpthread"
export CXX=/usr/bin/gcc-11
export LDFLAGS="-lstdc++"
autoreconf -i
./configure
make

I noticed this warning:

In function ‘int snprintf(char*, size_t, const char*, ...)’,
    inlined from ‘void cmd_dev_add_usage(char*)’ at ublksrv_tgt.cpp:609:22:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:67:35: warning: ‘int __builtin___snprintf_chk(char*, long unsigned int, int, long unsigned int, const char*, ...)’ specified bound 4096 exceeds destination size 4092 [-Wstringop-overflow=]
   67 |   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
      |          ~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   68 |                                    __bos (__s), __fmt, __va_arg_pack ());
      |                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.. and that the tool core dumped

#./ublk help
*** buffer overflow detected ***: terminated
Aborted (core dumped)

Turns out that the string buffer data.names is not 4096 bytes long, so this patch corrects the length handed to snprintfs and removes the hard coding to avoid any future issues if more members are added to the struct.

Thanks, Hans