@@ -81,7 +81,7 @@ static char *nf_osf_strchr(char *ptr, char c)
if (tmp)
*tmp = '\0';
- while (tmp && tmp + 1 && isspace(*(tmp + 1)))
+ while (tmp && isspace(*(tmp + 1)))
tmp++;
return tmp;
@@ -289,32 +289,34 @@ static int osf_load_line(char *buffer, int len, int del,
pend = nf_osf_strchr(pbeg, OSFPDEL);
if (pend) {
*pend = '\0';
- cnt = snprintf(obuf, sizeof(obuf), "%s,", pbeg);
+ i = sizeof(obuf);
+ cnt = snprintf(obuf, i, "%.*s,", i - 2, pbeg);
pbeg = pend + 1;
}
pend = nf_osf_strchr(pbeg, OSFPDEL);
if (pend) {
*pend = '\0';
+ i = sizeof(f.genre);
if (pbeg[0] == '@' || pbeg[0] == '*')
- cnt = snprintf(f.genre, sizeof(f.genre), "%s", pbeg + 1);
- else
- cnt = snprintf(f.genre, sizeof(f.genre), "%s", pbeg);
+ pbeg++;
+ cnt = snprintf(f.genre, i, "%.*s", i - 1, pbeg);
pbeg = pend + 1;
}
pend = nf_osf_strchr(pbeg, OSFPDEL);
if (pend) {
*pend = '\0';
- cnt = snprintf(f.version, sizeof(f.version), "%s", pbeg);
+ i = sizeof(f.version);
+ cnt = snprintf(f.version, i, "%.*s", i - 1, pbeg);
pbeg = pend + 1;
}
pend = nf_osf_strchr(pbeg, OSFPDEL);
if (pend) {
*pend = '\0';
- cnt =
- snprintf(f.subtype, sizeof(f.subtype), "%s", pbeg);
+ i = sizeof(f.subtype);
+ cnt = snprintf(f.subtype, i, "%.*s", i - 1, pbeg);
pbeg = pend + 1;
}
Fedora 30 uses very recent gcc (version 9.1.1 20190503 (Red Hat 9.1.1-1)), osf produces following warnings: -Wformat-truncation warning have been introduced in the version 7.1 of gcc. Also, remove a unneeded address check of "tmp + 1" in nf_osf_strchr(). nfnl_osf.c: In function ‘nfnl_osf_load_fingerprints’: nfnl_osf.c:292:39: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 128 [-Wformat-truncation=] 292 | cnt = snprintf(obuf, sizeof(obuf), "%s,", pbeg); | ^~ nfnl_osf.c:292:9: note: ‘snprintf’ output between 2 and 1025 bytes into a destination of size 128 292 | cnt = snprintf(obuf, sizeof(obuf), "%s,", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ nfnl_osf.c:302:46: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 32 [-Wformat-truncation=] 302 | cnt = snprintf(f.genre, sizeof(f.genre), "%s", pbeg); | ^~ nfnl_osf.c:302:10: note: ‘snprintf’ output between 1 and 1024 bytes into a destination of size 32 302 | cnt = snprintf(f.genre, sizeof(f.genre), "%s", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ nfnl_osf.c:309:49: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 32 [-Wformat-truncation=] 309 | cnt = snprintf(f.version, sizeof(f.version), "%s", pbeg); | ^~ nfnl_osf.c:309:9: note: ‘snprintf’ output between 1 and 1024 bytes into a destination of size 32 309 | cnt = snprintf(f.version, sizeof(f.version), "%s", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ nfnl_osf.c:317:47: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 32 [-Wformat-truncation=] 317 | snprintf(f.subtype, sizeof(f.subtype), "%s", pbeg); | ^~ nfnl_osf.c:317:7: note: ‘snprintf’ output between 1 and 1024 bytes into a destination of size 32 317 | snprintf(f.subtype, sizeof(f.subtype), "%s", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> --- src/nfnl_osf.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)