sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

util: CID 1499409: Memory - corruptions (OVERLAPPING_COPY)

Browse Source 
This is quite bizarre:

*** CID 1499409:  Memory - corruptions  (OVERLAPPING_COPY)
/lib/util/debug.c: 1742 in dbghdrclass()
1736     					 sizeof(tvbuf.buf),
1737     					 "%ld seconds since the Epoch", (long)t);
1738     			}
1739     		}
1740
1741     		ensure_hostname();
>>>     CID 1499409:  Memory - corruptions  (OVERLAPPING_COPY)
>>>     In the call to function "snprintf", the object pointed to by argument "state.hostname" may overlap with the object pointed to by argument "state.header_str".
1742     		state.hs_len = snprintf(state.header_str,
1743     					sizeof(state.header_str),
1744     					"%s %s %s[%u]: ",
1745     					tvbuf.buf,
1746     					state.hostname,
1747     					state.prog_name,

Coverity doesn't explicitly say so but the only way this can happen is
if state.hostname is not NUL-terminated within its declared length.
ensure_hostname() and debug_set_hostname() ensure NUL-termination, but
the caching effect of ensure_hostname() probably stops Coverity from
being certain about anything.

Try making Coverity happy by using a precision to limit the number of
characters from hostname that can be used.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Feb 22 00:17:12 UTC 2022 on sn-devel-184
This commit is contained in:
Martin Schwenke 2022-02-18 12:02:50 +11:00 committed by Martin Schwenke
parent 521e119564
commit a2590298b0
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/util/debug.c
View File

@ -1741,8 +1741,9 @@ bool dbghdrclass(int level, int cls, const char *location, const char *func)
ensure_hostname();
state.hs_len = snprintf(state.header_str,
sizeof(state.header_str),
"%s %s %s[%u]: ",
"%s %.*s %s[%u]: ",
tvbuf.buf,
(int)(sizeof(state.hostname) - 1),
state.hostname,
state.prog_name,
(unsigned int) getpid());