kconfig: use snprintf for formatting pathnames (b9d1a8e9) · Commits · 戴 / test

Valid pathnames will never exceed PATH_MAX, but these file names are unsanitized and can cause buffer overflow if set incorrectly. Use snprintf to avoid this. This was flagged during a Coverity scan of the coreboot project, which also uses kconfig for its build system. Signed-off-by:

Jacob Garber <jgarber1@ualberta.ca> Signed-off-by:

Masahiro Yamada <yamada.masahiro@socionext.com>

scripts/kconfig/confdata.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -241,7 +241,7 @@ char *conf_get_default_confname(void)
		name = expand_string(conf_defname);
		env = getenv(SRCTREE);
		if (env) {
		sprintf(fullname, "%s/%s", env, name);
		snprintf(fullname, sizeof(fullname), "%s/%s", env, name);
		if (is_present(fullname))
		return fullname;
		}

scripts/kconfig/lexer.l

+2 −1

Original line number	Diff line number	Diff line
		@@ -378,7 +378,8 @@ FILE zconf_fopen(const char name)
		if (!f && name != NULL && name[0] != '/') {
		env = getenv(SRCTREE);
		if (env) {
		sprintf(fullname, "%s/%s", env, name);
		snprintf(fullname, sizeof(fullname),
		"%s/%s", env, name);
		f = fopen(fullname, "r");
		}
		}

Admin message