Changeset 14a218f in rtems


Ignore:
Timestamp:
Aug 21, 2018, 3:32:48 PM (11 months ago)
Author:
Joel Sherrill <joel@…>
Branches:
master
Children:
c2e8ed6
Parents:
cba349c
git-author:
Joel Sherrill <joel@…> (08/21/18 15:32:48)
git-committer:
Joel Sherrill <joel@…> (08/29/18 17:52:08)
Message:

cpukit/telnetd/pty.c: Fix format overflow warning on sprintf()

cpukit/telnetd/pty.c:436:47: warning: '%X' directive writing between

1 and 8 bytes into a region of size 3 [-Wformat-overflow=]

The devname area was malloc'ed. Now it is statically allocated and
sufficiently large to account for the potential buffer overflow.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • cpukit/telnetd/pty.c

    rcba349c r14a218f  
    7272
    7373struct pty_tt {
    74  char                     *devname;
     74 char                      devname[17];
    7575 struct rtems_termios_tty *ttyp;
    7676 tcflag_t                  c_cflag;
     
    433433
    434434  for (ndx=0;ndx<rtems_telnetd_maximum_ptys;ndx++) {
    435     telnet_ptys[ndx].devname = (char*)malloc(strlen("/dev/ptyXX")+1);
    436     sprintf(telnet_ptys[ndx].devname,"/dev/pty%X",ndx);
     435    /* devname is included in the structure */
     436    sprintf(telnet_ptys[ndx].devname,"/dev/pty%02X",ndx);
    437437    telnet_ptys[ndx].ttyp    =  NULL;
    438438    telnet_ptys[ndx].c_cflag = CS8|B9600;
     
    492492        if (status != RTEMS_SUCCESSFUL)
    493493          perror("removing pty device node from file system");
    494         else
    495           free(telnet_ptys[ndx].devname);
     494        else {
     495          telnet_ptys[ndx].devname[0] = '\0';
     496        }
    496497    };
    497498
Note: See TracChangeset for help on using the changeset viewer.