[LU-4848] mdd_migrate_entries() uses snprintf() incorrectly

• Status: Resolved
• Project: Lustre
• Affects Version/s: Lustre 2.6.0
• Type: Bug
• Priority: Minor
• Reporter: John Hammond
• Assignee: WC Triage
• Resolution: Done
• Labels: mdd
• Severity: 3

Description

In mdd_migrate_entries(), lde_namelen + 1 is passed as the buffer size argument.

char *name = mdd_env_info(env)->mti_key;
...
snprintf(name, ent->lde_namelen + 1, "%s", ent->lde_name);

This is not the buffer size and in fact comes from disk. This should be:

char *name = mdd_env_info(env)->mti_key;
size_t name_size = sizeof(mdd_env_info(env)->mti_key);
...
snprintf(name, name_size, "%.*s", (int)ent->lde_namelen + 1, ent->lde_name);

Also recsize and lde_namelen should be validated against the allocated size of ent and (NAME_MAX). Currently recsize is set but unused.

Comments

[Andreas Dilger]

This code no longer exists.