Skip to content

Commit bda9af7

Browse files
KuzinAndreybvanassche
authored andcommitted
Fix: Use snprintf() for device path generation
Compilation warning: mibgroup/ucd-snmp/diskio_linux.c: In function 'diskio_parse_config_disks': mibgroup/ucd-snmp/diskio_linux.c:184:5: warning: '__builtin___strncat_chk' output may be truncated copying 1023 bytes from a string of length 1023 [-Wstringop-truncation] 184 | strncat(device, path, STRMAX - 1); | ^ Use of strncat() is totally insecure for any buffer overruns attacks (see 'man strncat' for details). Fix it with use more friendly function to string end '\0'.
1 parent 3328a67 commit bda9af7

File tree

1 file changed

+2
-5
lines changed

1 file changed

+2
-5
lines changed

agent/mibgroup/ucd-snmp/diskio_linux.c

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -177,11 +177,8 @@ add_device(char *path, int addNewDisks)
177177
}
178178

179179
/* first find the path for this device */
180-
device[0] = '\0';
181-
if (*path != '/') {
182-
strlcpy(device, "/dev/", STRMAX - 1);
183-
}
184-
strncat(device, path, STRMAX - 1);
180+
if (STRMAX <= snprintf(device, STRMAX, "%s%s", (*path != '/') ? "/dev/" : "", path))
181+
netsnmp_config_error("Device path '%s' is too long and was truncated to '%s'", path, device);
185182

186183
/* check for /dev existence */
187184
if (stat(device, &stbuf) != 0) { /* ENOENT */

0 commit comments

Comments
 (0)