From 74e8328d3f6901d6ba38a313965fe910c8411324 Mon Sep 17 00:00:00 2001 From: Amar Tumballi Date: Thu, 1 Nov 2018 07:25:25 +0530 Subject: all: fix the format string exceptions Currently, there are possibilities in few places, where a user-controlled (like filename, program parameter etc) string can be passed as 'fmt' for printf(), which can lead to segfault, if the user's string contains '%s', '%d' in it. While fixing it, makes sense to make the explicit check for such issues across the codebase, by making the format call properly. Fixes: CVE-2018-14661 Fixes: bz#1644763 Change-Id: Ib547293f2d9eb618594cbff0df3b9c800e88bde4 Signed-off-by: Amar Tumballi --- xlators/performance/io-cache/src/io-cache.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'xlators/performance/io-cache/src') diff --git a/xlators/performance/io-cache/src/io-cache.c b/xlators/performance/io-cache/src/io-cache.c index 6ffad7d1a64..380ba876cba 100644 --- a/xlators/performance/io-cache/src/io-cache.c +++ b/xlators/performance/io-cache/src/io-cache.c @@ -1868,7 +1868,7 @@ __ioc_page_dump(ioc_page_t *page, char *prefix) goto out; { gf_proc_dump_write("offset", "%" PRId64, page->offset); - gf_proc_dump_write("size", "%" PRId64, page->size); + gf_proc_dump_write("size", "%" GF_PRI_SIZET, page->size); gf_proc_dump_write("dirty", "%s", page->dirty ? "yes" : "no"); gf_proc_dump_write("ready", "%s", page->ready ? "yes" : "no"); ioc_page_waitq_dump(page, prefix); @@ -1962,7 +1962,7 @@ ioc_inode_dump(xlator_t *this, inode_t *inode) if (gf_uuid_is_null(ioc_inode->inode->gfid)) goto unlock; - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); section_added = _gf_true; __inode_path(ioc_inode->inode, NULL, &path); @@ -1985,7 +1985,7 @@ unlock: out: if (ret && ioc_inode) { if (section_added == _gf_false) - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("Unable to print the status of ioc_inode", "(Lock acquisition failed) %s", uuid_utoa(inode->gfid)); @@ -2009,7 +2009,7 @@ ioc_priv_dump(xlator_t *this) priv = this->private; gf_proc_dump_build_key(key_prefix, "io-cache", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); add_section = _gf_true; ret = pthread_mutex_trylock(&priv->table_lock); @@ -2021,8 +2021,8 @@ ioc_priv_dump(xlator_t *this) gf_proc_dump_write("cache_used", "%ld", priv->cache_used); gf_proc_dump_write("inode_count", "%u", priv->inode_count); gf_proc_dump_write("cache_timeout", "%u", priv->cache_timeout); - gf_proc_dump_write("min-file-size", "%u", priv->min_file_size); - gf_proc_dump_write("max-file-size", "%u", priv->max_file_size); + gf_proc_dump_write("min-file-size", "%" PRIu64, priv->min_file_size); + gf_proc_dump_write("max-file-size", "%" PRIu64, priv->max_file_size); } pthread_mutex_unlock(&priv->table_lock); out: @@ -2032,7 +2032,7 @@ out: "xlator." "performance.io-cache", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); } gf_proc_dump_write( "Unable to dump the state of private " -- cgit