Red Hat Bugzilla – Bug 717860
Static array overrun
Last modified: 2011-12-06 12:56:51 EST
Description of problem:
/daemon/opd_ibs.c:636, 652 - Function strncat may cause overrunning of string variable filename if length of session_dir is greater than 1005.
Version-Release number of selected component (if applicable):
These defects were probably introduced by Red Hat patches.
This code is directly from the upstream oprofile, so the problem also exists in newer upstream versions of oprofile:
Patch has been reviewed and will be in upstream oprofile. Built RHEL-6 oprofile with patch.
cppcheck shows this is fixed:
:: [17:24:25] :: --- /tmp/tmp.IhRdJzrB62/output1.log 2011-09-30 17:24:05.228962036 +0200
:: [17:24:25] :: +++ /tmp/tmp.IhRdJzrB62/output2.log 2011-09-30 17:24:24.258111476 +0200
:: [17:24:25] :: @@ -3,2 +2,0 @@
:: [17:24:25] :: -daemon/opd_ibs.c@line 636: Dangerous usage of 'filename' (strncpy doesn't always 0-terminate it) [error]
:: [17:24:25] :: -daemon/opd_ibs.c@line 652: Dangerous usage of 'filename' (strncpy doesn't always 0-terminate it) [error]
Moving to VERIFIED
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.