Commit f07c9a79 authored Apr 26, 2012 by Jim Meyering Committed by Josef Bacik May 30, 2012

Btrfs: avoid buffer overrun in btrfs_printk



The buffer read-overrun would be triggered by a printk format
starting with <N>, where N is a single digit.  NUL-terminate
after strncpy.  Use memcpy, not strncpy, since we know the
string we're copying fits in the destination buffer and
contains no NUL byte.

Signed-off-by: Jim Meyering <meyering@redhat.com>

parent 2eec6c81

fs/btrfs/super.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -188,7 +188,8 @@ void btrfs_printk(struct btrfs_fs_info fs_info, const char fmt, ...)
		va_start(args, fmt);

		if (fmt[0] == '<' && isdigit(fmt[1]) && fmt[2] == '>') {
		strncpy(lvl, fmt, 3);
		memcpy(lvl, fmt, 3);
		lvl[3] = '\0';
		fmt += 3;
		type = logtypes[fmt[1] - '0'];
		} else