Bug 556678

Created attachment 385305 [details]
Patch to prevent stack buffer overflow

Description of problem:
One of the buffers is too small, and coding is inherently unsafe

Version-Release number of selected component (if applicable):
strace-4.5.19-1

How reproducible:
Always

Steps to Reproduce:
1. see patch
  
Actual results:


Expected results:


Additional info:
Generally it is always code defensively and use snprintf rather than sprintf especially when using buffers on the stack(!), and also to ensure that literal constants don't have to be repeated (and match) in different places, eg:
NEVER
> char str[40];
> snprintf(str, 39, ...).
ALWAYS
> char str[40];
> snprintf(str, sizeof(str)-1, ...);

But in any case how can constructs such as sprintf() onto a fixed size buffer on the stack escape the attention of automatic bad-code detection tools. Wait ... you don't use such tools?. Shame!