Bug 2044122

Description of problem:

sgpio command aborted with *** buffer overflow detected ***

The following stacktrace was output.

systemd-coredump[XXXX]: Process XXXX (sgpio) of user 0 dumped core.#012#012
Stack trace of thread 39201:#012
#0  0x00007fcf5d06c37f raise (libc.so.6)#012
#1  0x00007fcf5d056db5 abort (libc.so.6)#012
#2  0x00007fcf5d0af4e7 __libc_message (libc.so.6)#012
#3  0x00007fcf5d142365 __GI___fortify_fail_abort (libc.so.6)#012
#4  0x00007fcf5d142397 __fortify_fail (libc.so.6)#012
#5  0x00007fcf5d140356 __chk_fail (libc.so.6)#012
#6  0x00007fcf5d13f9bf _IO_str_chk_overflow (libc.so.6)#012
#7  0x00007fcf5d0b3611 _IO_default_xsputn (libc.so.6)#012
#8  0x00007fcf5d085dc8 vfprintf (libc.so.6)#012
#9  0x00007fcf5d13fa63 __vsprintf_chk (libc.so.6)#012
#10 0x00007fcf5d13f98e __sprintf_chk (libc.so.6)#012
#11 0x0000556a44c85bd9 led_set (sgpio)#012
#12 0x0000556a44c850f3 main (sgpio)#012
#13 0x00007fcf5d058493 __libc_start_main (libc.so.6)#012
#14 0x0000556a44c8565e _start (sgpio)

This following is the relative code.

struct disk{
        struct led_context data[LEDS_PER_DISK];
        int id;
        int host_port;
        int init;
        char name[7];
};
... snip ...
int led_set(int port_num){
... snip ...

        /* Give the port a name */
        if(sprintf(disks[index].name,"Port %d", port_num) < 0){
                printf("Error: Unable to write port number to buffor!\n");
                return -1;
        }

The name member of the struct disk is the char type array with 7 length.
Basically, last one name[6] should be \0.
So, the name member can be used for almost 6 characters.

The "Port %d" can be more than 7 characters, when the port number length is more than 2. So, the buffer overflow was detected and aborted.

The following is the simple fix.

$ cat sgpio-larger-portnum.patch
diff -up sgpio/sgpio.c.original sgpio/sgpio.c
--- sgpio/sgpio.c.original	2022-01-24 11:20:31.486061764 +0900
+++ sgpio/sgpio.c	2022-01-24 11:23:00.677783531 +0900
@@ -126,7 +126,7 @@ struct disk{
 	int id;
 	int host_port;
 	int init;
-	char name[7];
+	char name[8];
 };
 
 /* structure for the disks associated with the led structure */


Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux 8.5

How reproducible:
Always with the scsi port number of more than 2 digits.

Steps to Reproduce:
1. Find a disk with the scsi port number of more than 2 digits.
2. Run sgpio -d <device> -s locate

   <device> is something like sda

Actual results:
sgpio command aborted.

Expected results:
sgpio command never aborted.

Additional info: