From d65f3ea18eb08925bec3afc169869ee1a2453c81 Mon Sep 17 00:00:00 2001 From: Neels Hofmeyr Date: Wed, 28 Mar 2018 16:12:45 +0200 Subject: vty/command.c: write_config_file(): sanely compose temp path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix GCC version 7.3.0 (Debian 7.3.0-12) compiler warning: ../../../../src/libosmocore/src/vty/command.c: In function ‘write_config_file’: ../../../../src/libosmocore/src/vty/command.c:2741:2: error: null destination pointer [-Werror=format-overflow=] sprintf(config_file_tmp, "%s.XXXXXX", config_file); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Check agains NULL after each _talloc_zero() in write_config_file(). While at it, add a comment explaining why we don't use talloc_asprintf() instead. Change-Id: I7bdc52afe724c1d21f419fe49a6e2ebca9420969 --- src/vty/command.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'src/vty/command.c') diff --git a/src/vty/command.c b/src/vty/command.c index 71f6a71e..24d8ea41 100644 --- a/src/vty/command.c +++ b/src/vty/command.c @@ -2728,16 +2728,26 @@ static int write_config_file(const char *config_file, char **outpath) *outpath = NULL; + /* The string composition code here would be a case for talloc_asprintf(), but the pseudotalloc.c + * talloc_asprintf() implementation would truncate a too-long path with "[...]", so doing it + * manually instead. */ + /* Check and see if we are operating under vtysh configuration */ config_file_sav = _talloc_zero(tall_vty_cmd_ctx, strlen(config_file) + strlen(CONF_BACKUP_EXT) + 1, "config_file_sav"); + if (!config_file_sav) + return -1; strcpy(config_file_sav, config_file); strcat(config_file_sav, CONF_BACKUP_EXT); config_file_tmp = _talloc_zero(tall_vty_cmd_ctx, strlen(config_file) + 8, - "config_file_tmp"); + "config_file_tmp"); + if (!config_file_tmp) { + talloc_free(config_file_sav); + return -1; + } sprintf(config_file_tmp, "%s.XXXXXX", config_file); /* Open file to configuration write. */ -- cgit v1.2.3