On 2/2/24 16:02, David Laight wrote:

From: Denis Kirjanov

quoted

Sent: 02 February 2024 12:24

On 2/2/24 14:32, David Laight wrote:

quoted

From: Stephen Hemminger

quoted

Sent: 31 January 2024 16:14

quoted

On Wed, 31 Jan 2024 07:41:07 -0500
Denis Kirjanov [off-list ref] wrote:

quoted

@@ -893,7 +893,7 @@ int main(int argc, char *argv[])

 	sun.sun_family = AF_UNIX;
 	sun.sun_path[0] = 0;
-	sprintf(sun.sun_path+1, "ifstat%d", getuid());
+	snprintf(sun.sun_path+1, sizeof(sun.sun_path), "ifstat%d", getuid());

If you are changing the line, please add spaces around plus sign

Isn't the size also wrong - needs a matching '- 1'.

I don't think it's wrong, it's just the size of the target buffer which is
UNIX_PATH_MAX bytes.

But you are starting one byte in.
So, if the size were 8 the '\0' would be written after the end.

yep, you're right

Also, to avoid the next patch in a few weeks it should be
calling scnprintf().

I'll post the next version

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)