[LU-4848] mdd_migrate_entries() uses snprintf() incorrectly

Thu, 9 Jan 2020 07:30:12 +0000

In mdd_migrate_entries(), lde_namelen + 1 is passed as the buffer size argument.

char *name = mdd_env_info(env)->mti_key;
...
snprintf(name, ent->lde_namelen + 1, "%s", ent->lde_name);

This is not the buffer size and in fact comes from disk. This should be:

char *name = mdd_env_info(env)->mti_key;
size_t name_size = sizeof(mdd_env_info(env)->mti_key);
...
snprintf(name, name_size, "%.*s", (int)ent->lde_namelen + 1, ent->lde_name);

Also recsize and lde_namelen should be validated against the allocated size of ent and (NAME_MAX). Currently recsize is set but unused.

Whamcloud Community JIRA

[LU-4848] mdd_migrate_entries() uses snprintf() incorrectly