all: fix the format string exceptions

Currently, there are possibilities in few places, where a user-controlled
(like filename, program parameter etc) string can be passed as 'fmt' for
printf(), which can lead to segfault, if the user's string contains '%s',
'%d' in it.

While fixing it, makes sense to make the explicit check for such issues
across the codebase, by making the format call properly.

Fixes: CVE-2018-14661

Fixes: bz#1644763
Change-Id: Ib547293f2d9eb618594cbff0df3b9c800e88bde4
Signed-off-by: Amar Tumballi <amarts@redhat.com>

1 files changed, 7 insertions, 6 deletions

diff --git a/libglusterfs/src/statedump.c b/libglusterfs/src/statedump.c
index d0701e53a84..0f4a7102697 100644
--- a/libglusterfs/src/statedump.c
+++ b/libglusterfs/src/statedump.c
@@ -255,12 +255,13 @@ gf_proc_dump_xlator_mem_info_only_in_use(xlator_t *xl)
         gf_proc_dump_add_section("%s.%s - usage-type %d", xl->type, xl->name,
                                  i);
 
-        gf_proc_dump_write("size", "%u", xl->mem_acct->rec[i].size);
-        gf_proc_dump_write("max_size", "%u", xl->mem_acct->rec[i].max_size);
+        gf_proc_dump_write("size", "%" PRIu64, xl->mem_acct->rec[i].size);
+        gf_proc_dump_write("max_size", "%" PRIu64,
+                           xl->mem_acct->rec[i].max_size);
         gf_proc_dump_write("num_allocs", "%u", xl->mem_acct->rec[i].num_allocs);
         gf_proc_dump_write("max_num_allocs", "%u",
                            xl->mem_acct->rec[i].max_num_allocs);
-        gf_proc_dump_write("total_allocs", "%u",
+        gf_proc_dump_write("total_allocs", "%" PRIu64,
                            xl->mem_acct->rec[i].total_allocs);
     }
 
@@ -379,8 +380,8 @@ gf_proc_dump_mempool_info(glusterfs_ctx_t *ctx)
             gf_proc_dump_write("-----", "-----");
             gf_proc_dump_write("pool-name", "%s", pool->name);
             gf_proc_dump_write("active-count", "%" GF_PRI_ATOMIC, active);
-            gf_proc_dump_write("sizeof-type", "%d", pool->sizeof_type);
-            gf_proc_dump_write("padded-sizeof", "%lu",
+            gf_proc_dump_write("sizeof-type", "%lu", pool->sizeof_type);
+            gf_proc_dump_write("padded-sizeof", "%d",
                                1 << pool->pool->power_of_two);
             gf_proc_dump_write("size", "%lu",
                                (1 << pool->pool->power_of_two) * active);
@@ -466,7 +467,7 @@ gf_proc_dump_dict_info(glusterfs_ctx_t *ctx)
     total_dicts = GF_ATOMIC_GET(ctx->stats.total_dicts_used);
     total_pairs = GF_ATOMIC_GET(ctx->stats.total_pairs_used);
 
-    gf_proc_dump_write("max-pairs-per-dict", "%u",
+    gf_proc_dump_write("max-pairs-per-dict", "%" GF_PRI_ATOMIC,
                        GF_ATOMIC_GET(ctx->stats.max_dict_pairs));
     gf_proc_dump_write("total-pairs-used", "%lu", total_pairs);
     gf_proc_dump_write("total-dicts-used", "%lu", total_dicts);