The Samba-Bugzilla – Attachment 18730 Details for
Bug 15918
Buffer overflow in CTDB Infiniband support
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch v2
0001-CVE-2025-59519-ctdb-ib-Replace-uses-of-sprintf.patch (text/plain), 18.27 KB, created by
Martin Schwenke
on 2025-09-19 05:30:42 UTC
(
hide
)
Description:
Patch v2
Filename:
MIME Type:
Creator:
Martin Schwenke
Created:
2025-09-19 05:30:42 UTC
Size:
18.27 KB
patch
obsolete
>From d744cf5eaafcc6cab7c108d206890f713346c44b Mon Sep 17 00:00:00 2001 >From: Martin Schwenke <mschwenke@ddn.com> >Date: Thu, 18 Sep 2025 15:24:32 +1000 >Subject: [PATCH] CVE-2025-59519: ctdb-ib: Replace uses of sprintf() >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >An unbounded sprintf() into ibw_lasterr (a 512-byte static data >buffer). An attacker can send crafted data causing strings longer than >512 bytes to be logged into ibw_lasterr, triggering static data >corruption and a crash, or potential remote code execution. > >The risk is minimised due to: > >* This code is not built by default (--enable-infiniband is > required). > > It appears that Debian and Red Hat family Linux distributions have > never distributed binaries with this enabled. > >* Documentation (ctdb(7) and the wiki) recommends that private > addresses are configured on a private network that is separate from > client networks. > >Only the instance with %s in the format is problematic. The others >can not overflow the current 512 byte buffer. However, it makes sense >to change them all in case someone foolishly reduces the size of the >buffer. > >Now, will static analysers complain that the result of snprintf() is >not checked even though snprintf() always NUL-terminates? > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=15918 > >Signed-off-by: Martin Schwenke <mschwenke@ddn.com> >Reported-by: Marcos âTr0pâ Tolosa <marcos.tolosa@owasp.org> >--- > ctdb/ib/ibwrapper.c | 243 ++++++++++++++++++++++++++++++++++---------- > 1 file changed, 190 insertions(+), 53 deletions(-) > >diff --git a/ctdb/ib/ibwrapper.c b/ctdb/ib/ibwrapper.c >index cf4efa579e2..24fb301824a 100644 >--- a/ctdb/ib/ibwrapper.c >+++ b/ctdb/ib/ibwrapper.c >@@ -61,13 +61,17 @@ static void *ibw_alloc_mr(struct ibw_ctx_priv *pctx, struct ibw_conn_priv *pconn > DEBUG(DEBUG_DEBUG, ("ibw_alloc_mr(cmid=%p, n=%u)\n", pconn->cm_id, n)); > buf = memalign(pctx->pagesize, n); > if (!buf) { >- sprintf(ibw_lasterr, "couldn't allocate memory\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "couldn't allocate memory\n"); > return NULL; > } > > *ppmr = ibv_reg_mr(pconn->pd, buf, n, IBV_ACCESS_LOCAL_WRITE); > if (!*ppmr) { >- sprintf(ibw_lasterr, "couldn't allocate mr\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "couldn't allocate mr\n"); > free(buf); > return NULL; > } >@@ -100,14 +104,18 @@ static int ibw_init_memory(struct ibw_conn *conn) > pconn->buf_send = ibw_alloc_mr(pctx, pconn, > opts->max_send_wr * opts->recv_bufsize, &pconn->mr_send); > if (!pconn->buf_send) { >- sprintf(ibw_lasterr, "couldn't allocate work send buf\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "couldn't allocate work send buf\n"); > return -1; > } > > pconn->buf_recv = ibw_alloc_mr(pctx, pconn, > opts->max_recv_wr * opts->recv_bufsize, &pconn->mr_recv); > if (!pconn->buf_recv) { >- sprintf(ibw_lasterr, "couldn't allocate work recv buf\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "couldn't allocate work recv buf\n"); > return -1; > } > >@@ -253,7 +261,10 @@ static int ibw_setup_cq_qp(struct ibw_conn *conn) > /* init verbs */ > pconn->verbs_channel = ibv_create_comp_channel(pconn->cm_id->verbs); > if (!pconn->verbs_channel) { >- sprintf(ibw_lasterr, "ibv_create_comp_channel failed %d\n", errno); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibv_create_comp_channel failed %d\n", >+ errno); > return -1; > } > DEBUG(DEBUG_DEBUG, ("created channel %p\n", pconn->verbs_channel)); >@@ -263,7 +274,10 @@ static int ibw_setup_cq_qp(struct ibw_conn *conn) > > pconn->pd = ibv_alloc_pd(pconn->cm_id->verbs); > if (!pconn->pd) { >- sprintf(ibw_lasterr, "ibv_alloc_pd failed %d\n", errno); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibv_alloc_pd failed %d\n", >+ errno); > return -1; > } > DEBUG(DEBUG_DEBUG, ("created pd %p\n", pconn->pd)); >@@ -277,13 +291,18 @@ static int ibw_setup_cq_qp(struct ibw_conn *conn) > pctx->opts.max_recv_wr + pctx->opts.max_send_wr, > conn, pconn->verbs_channel, 0); > if (pconn->cq==NULL) { >- sprintf(ibw_lasterr, "ibv_create_cq failed\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibv_create_cq failed\n"); > return -1; > } > > rc = ibv_req_notify_cq(pconn->cq, 0); > if (rc) { >- sprintf(ibw_lasterr, "ibv_req_notify_cq failed with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibv_req_notify_cq failed with %d\n", >+ rc); > return rc; > } > >@@ -299,14 +318,20 @@ static int ibw_setup_cq_qp(struct ibw_conn *conn) > > rc = rdma_create_qp(pconn->cm_id, pconn->pd, &init_attr); > if (rc) { >- sprintf(ibw_lasterr, "rdma_create_qp failed with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_create_qp failed with %d\n", >+ rc); > return rc; > } > /* elase result is in pconn->cm_id->qp */ > > rc = ibv_query_qp(pconn->cm_id->qp, &attr, IBV_QP_PATH_MTU, &init_attr); > if (rc) { >- sprintf(ibw_lasterr, "ibv_query_qp failed with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibv_query_qp failed with %d\n", >+ rc); > return rc; > } > >@@ -338,7 +363,10 @@ static int ibw_refill_cq_recv(struct ibw_conn *conn) > > rc = ibv_post_recv(pconn->cm_id->qp, &wr, &bad_wr); > if (rc) { >- sprintf(ibw_lasterr, "refill/ibv_post_recv failed with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "refill/ibv_post_recv failed with %d\n", >+ rc); > DEBUG(DEBUG_ERR, ("%s", ibw_lasterr)); > return -2; > } >@@ -372,7 +400,10 @@ static int ibw_fill_cq(struct ibw_conn *conn) > > rc = ibv_post_recv(pconn->cm_id->qp, &wr, &bad_wr); > if (rc) { >- sprintf(ibw_lasterr, "fill/ibv_post_recv failed with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "fill/ibv_post_recv failed with %d\n", >+ rc); > DEBUG(DEBUG_ERR, ("%s", ibw_lasterr)); > return -2; > } >@@ -400,7 +431,10 @@ static int ibw_manage_connect(struct ibw_conn *conn) > > rc = rdma_connect(pconn->cm_id, &conn_param); > if (rc) >- sprintf(ibw_lasterr, "rdma_connect error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_connect error %d\n", >+ rc); > > return rc; > } >@@ -422,7 +456,10 @@ static void ibw_event_handler_cm(struct tevent_context *ev, > if (rc) { > ctx->state = IBWS_ERROR; > event = NULL; >- sprintf(ibw_lasterr, "rdma_get_cm_event error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_get_cm_event error %d\n", >+ rc); > goto error; > } > cma_id = event->id; >@@ -436,7 +473,10 @@ static void ibw_event_handler_cm(struct tevent_context *ev, > /* continuing from ibw_connect ... */ > rc = rdma_resolve_route(cma_id, 2000); > if (rc) { >- sprintf(ibw_lasterr, "rdma_resolve_route error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_resolve_route error %d\n", >+ rc); > goto error; > } > /* continued at RDMA_CM_EVENT_ROUTE_RESOLVED */ >@@ -501,19 +541,34 @@ static void ibw_event_handler_cm(struct tevent_context *ev, > break; > > case RDMA_CM_EVENT_ADDR_ERROR: >- sprintf(ibw_lasterr, "RDMA_CM_EVENT_ADDR_ERROR, error %d\n", event->status); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "RDMA_CM_EVENT_ADDR_ERROR, error %d\n", >+ event->status); > goto error; > case RDMA_CM_EVENT_ROUTE_ERROR: >- sprintf(ibw_lasterr, "RDMA_CM_EVENT_ROUTE_ERROR, error %d\n", event->status); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "RDMA_CM_EVENT_ROUTE_ERROR, error %d\n", >+ event->status); > goto error; > case RDMA_CM_EVENT_CONNECT_ERROR: >- sprintf(ibw_lasterr, "RDMA_CM_EVENT_CONNECT_ERROR, error %d\n", event->status); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "RDMA_CM_EVENT_CONNECT_ERROR, error %d\n", >+ event->status); > goto error; > case RDMA_CM_EVENT_UNREACHABLE: >- sprintf(ibw_lasterr, "RDMA_CM_EVENT_UNREACHABLE, error %d\n", event->status); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "RDMA_CM_EVENT_UNREACHABLE, error %d\n", >+ event->status); > goto error; > case RDMA_CM_EVENT_REJECTED: >- sprintf(ibw_lasterr, "RDMA_CM_EVENT_REJECTED, error %d\n", event->status); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "RDMA_CM_EVENT_REJECTED, error %d\n", >+ event->status); > DEBUG(DEBUG_INFO, ("cm event handler: %s", ibw_lasterr)); > conn = talloc_get_type(cma_id->context, struct ibw_conn); > if (conn) { >@@ -542,16 +597,24 @@ static void ibw_event_handler_cm(struct tevent_context *ev, > break; > > case RDMA_CM_EVENT_DEVICE_REMOVAL: >- sprintf(ibw_lasterr, "cma detected device removal!\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "cma detected device removal!\n"); > goto error; > > default: >- sprintf(ibw_lasterr, "unknown event %d\n", event->event); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "unknown event %d\n", >+ event->event); > goto error; > } > > if (event!=NULL && (rc=rdma_ack_cm_event(event))) { >- sprintf(ibw_lasterr, "rdma_ack_cm_event failed with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_ack_cm_event failed with %d\n", >+ rc); > goto error; > } > >@@ -596,23 +659,36 @@ static void ibw_event_handler_verbs(struct tevent_context *ev, > /* TODO: check whether if it's good to have more channels here... */ > rc = ibv_get_cq_event(pconn->verbs_channel, &ev_cq, &ev_ctx); > if (rc) { >- sprintf(ibw_lasterr, "Failed to get cq_event with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "Failed to get cq_event with %d\n", >+ rc); > goto error; > } > if (ev_cq != pconn->cq) { >- sprintf(ibw_lasterr, "ev_cq(%p) != pconn->cq(%p)\n", ev_cq, pconn->cq); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ev_cq(%p) != pconn->cq(%p)\n", >+ ev_cq, >+ pconn->cq); > goto error; > } > rc = ibv_req_notify_cq(pconn->cq, 0); > if (rc) { >- sprintf(ibw_lasterr, "Couldn't request CQ notification (%d)\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "Couldn't request CQ notification (%d)\n", >+ rc); > goto error; > } > > while((rc=ibv_poll_cq(pconn->cq, 1, &wc))==1) { > if (wc.status) { >- sprintf(ibw_lasterr, "cq completion failed status=%d, opcode=%d, rc=%d\n", >- wc.status, wc.opcode, rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "cq completion failed status=%d, opcode=%d, rc=%d\n", >+ wc.status, wc.opcode, >+ rc); > goto error; > } > >@@ -638,12 +714,18 @@ static void ibw_event_handler_verbs(struct tevent_context *ev, > break; > > default: >- sprintf(ibw_lasterr, "unknown completion %d\n", wc.opcode); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "unknown completion %d\n", >+ wc.opcode); > goto error; > } > } > if (rc!=0) { >- sprintf(ibw_lasterr, "ibv_poll_cq error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibv_poll_cq error %d\n", >+ rc); > goto error; > } > >@@ -737,8 +819,11 @@ static int ibw_wc_send(struct ibw_conn *conn, struct ibv_wc *wc) > if ((p->wr_id + pctx->opts.max_recv_wr)==(int)wc->wr_id) > break; > if (p==NULL) { >- sprintf(ibw_lasterr, "failed to find wr_id %d\n", (int)wc->wr_id); >- return -1; >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "failed to find wr_id %d\n", >+ (int)wc->wr_id); >+ return -1; > } > if (p->ref_cnt) { > p->ref_cnt--; >@@ -764,8 +849,11 @@ static int ibw_append_to_part(struct ibw_conn_priv *pconn, > assert(part->len==0); > part->buf = talloc_size(pconn, add_len); > if (part->buf==NULL) { >- sprintf(ibw_lasterr, "recv talloc_size error (%u) #%d\n", >- add_len, info); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "recv talloc_size error (%u) #%d\n", >+ add_len, >+ info); > return -1; > } > part->bufsize = add_len; >@@ -773,8 +861,12 @@ static int ibw_append_to_part(struct ibw_conn_priv *pconn, > part->buf = talloc_realloc_size(pconn, > part->buf, part->len + add_len); > if (part->buf==NULL) { >- sprintf(ibw_lasterr, "recv realloc error (%u + %u) #%d\n", >- part->len, add_len, info); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "recv realloc error (%u + %u) #%d\n", >+ part->len, >+ add_len, >+ info); > return -1; > } > } >@@ -802,7 +894,9 @@ static int ibw_wc_mem_threshold(struct ibw_conn_priv *pconn, > talloc_free(part->buf); > part->buf = talloc_size(pconn, threshold); > if (part->buf==NULL) { >- sprintf(ibw_lasterr, "talloc_size failed\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "talloc_size failed\n"); > return -1; > } > part->bufsize = threshold; >@@ -841,7 +935,10 @@ static int ibw_wc_recv(struct ibw_conn *conn, struct ibv_wc *wc) > /* set it again now... */ > part->to_read = *((uint32_t *)(part->buf)); /* TODO: ntohl */ > if (part->to_read<sizeof(uint32_t)) { >- sprintf(ibw_lasterr, "got msglen=%u #2\n", part->to_read); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "got msglen=%u #2\n", >+ part->to_read); > goto error; > } > part->to_read -= sizeof(uint32_t); /* it's already read */ >@@ -859,7 +956,10 @@ static int ibw_wc_recv(struct ibw_conn *conn, struct ibv_wc *wc) > if (remain>=sizeof(uint32_t)) { > uint32_t msglen = *(uint32_t *)p; /* TODO: ntohl */ > if (msglen<sizeof(uint32_t)) { >- sprintf(ibw_lasterr, "got msglen=%u\n", msglen); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "got msglen=%u\n", >+ msglen); > goto error; > } > >@@ -925,7 +1025,10 @@ static int ibw_process_init_attrs(struct ibw_initattr *attr, int nattr, struct i > else if (strcmp(name, "recv_threshold")==0) > opts->recv_threshold = atoi(value); > else { >- sprintf(ibw_lasterr, "ibw_init: unknown name %s\n", name); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibw_init: unknown name %s\n", >+ name); > return -1; > } > } >@@ -969,7 +1072,10 @@ struct ibw_ctx *ibw_init(struct ibw_initattr *attr, int nattr, > /* init cm */ > pctx->cm_channel = rdma_create_event_channel(); > if (!pctx->cm_channel) { >- sprintf(ibw_lasterr, "rdma_create_event_channel error %d\n", errno); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_create_event_channel error %d\n", >+ errno); > goto cleanup; > } > >@@ -983,7 +1089,10 @@ struct ibw_ctx *ibw_init(struct ibw_initattr *attr, int nattr, > #endif > if (rc) { > rc = errno; >- sprintf(ibw_lasterr, "rdma_create_id error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_create_id error %d\n", >+ rc); > goto cleanup; > } > DEBUG(DEBUG_DEBUG, ("created cm_id %p\n", pctx->cm_id)); >@@ -1030,7 +1139,10 @@ int ibw_bind(struct ibw_ctx *ctx, struct sockaddr_in *my_addr) > inet_ntoa(my_addr->sin_addr), ntohs(my_addr->sin_port))); > rc = rdma_bind_addr(pctx->cm_id, (struct sockaddr *) my_addr); > if (rc) { >- sprintf(ibw_lasterr, "rdma_bind_addr error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_bind_addr error %d\n", >+ rc); > DEBUG(DEBUG_ERR, ("%s", ibw_lasterr)); > return rc; > } >@@ -1047,7 +1159,10 @@ int ibw_listen(struct ibw_ctx *ctx, int backlog) > DEBUG(DEBUG_DEBUG, ("ibw_listen\n")); > rc = rdma_listen(pctx->cm_id, backlog); > if (rc) { >- sprintf(ibw_lasterr, "rdma_listen failed: %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_listen failed: %d\n", >+ rc); > DEBUG(DEBUG_ERR, ("%s", ibw_lasterr)); > return rc; > } >@@ -1069,7 +1184,10 @@ int ibw_accept(struct ibw_ctx *ctx, struct ibw_conn *conn, void *conn_userdata) > conn_param.initiator_depth = 1; > rc = rdma_accept(pconn->cm_id, &conn_param); > if (rc) { >- sprintf(ibw_lasterr, "rdma_accept failed %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_accept failed %d\n", >+ rc); > DEBUG(DEBUG_ERR, ("%s", ibw_lasterr)); > return -1;; > } >@@ -1108,7 +1226,10 @@ int ibw_connect(struct ibw_conn *conn, struct sockaddr_in *serv_addr, void *conn > #endif > if (rc) { > rc = errno; >- sprintf(ibw_lasterr, "ibw_connect/rdma_create_id error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibw_connect/rdma_create_id error %d\n", >+ rc); > talloc_free(conn); > return -1; > } >@@ -1116,7 +1237,10 @@ int ibw_connect(struct ibw_conn *conn, struct sockaddr_in *serv_addr, void *conn > > rc = rdma_resolve_addr(pconn->cm_id, NULL, (struct sockaddr *) serv_addr, 2000); > if (rc) { >- sprintf(ibw_lasterr, "rdma_resolve_addr error %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "rdma_resolve_addr error %d\n", >+ rc); > DEBUG(DEBUG_ERR, ("%s", ibw_lasterr)); > talloc_free(conn); > return -1; >@@ -1143,7 +1267,10 @@ int ibw_disconnect(struct ibw_conn *conn) > case IBWC_CONNECTED: > rc = rdma_disconnect(pconn->cm_id); > if (rc) { >- sprintf(ibw_lasterr, "ibw_disconnect failed with %d\n", rc); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibw_disconnect failed with %d\n", >+ rc); > DEBUG(DEBUG_ERR, ("%s", ibw_lasterr)); > return rc; > } >@@ -1173,7 +1300,9 @@ int ibw_alloc_send_buf(struct ibw_conn *conn, void **buf, void **key, uint32_t l > } else { > p->buf_large = ibw_alloc_mr(pctx, pconn, len, &p->mr_large); > if (p->buf_large==NULL) { >- sprintf(ibw_lasterr, "ibw_alloc_mr#1 failed\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibw_alloc_mr#1 failed\n"); > goto error; > } > *buf = (void *)p->buf_large; >@@ -1187,7 +1316,10 @@ int ibw_alloc_send_buf(struct ibw_conn *conn, void **buf, void **key, uint32_t l > p = pconn->extra_avail = talloc_zero(pconn, struct ibw_wr); > talloc_set_destructor(p, ibw_wr_destruct); > if (p==NULL) { >- sprintf(ibw_lasterr, "talloc_zero failed (emax: %u)\n", pconn->extra_max); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "talloc_zero failed (emax: %u)\n", >+ pconn->extra_max); > goto error; > } > p->wr_id = pctx->opts.max_send_wr + pconn->extra_max; >@@ -1203,7 +1335,9 @@ int ibw_alloc_send_buf(struct ibw_conn *conn, void **buf, void **key, uint32_t l > > p->buf_large = ibw_alloc_mr(pctx, pconn, len, &p->mr_large); > if (p->buf_large==NULL) { >- sprintf(ibw_lasterr, "ibw_alloc_mr#2 failed\n"); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibw_alloc_mr#2 failed\n"); > goto error; > } > *buf = (void *)p->buf_large; >@@ -1256,8 +1390,11 @@ static int ibw_send_packet(struct ibw_conn *conn, void *buf, struct ibw_wr *p, u > > rc = ibv_post_send(pconn->cm_id->qp, &wr, &bad_wr); > if (rc) { >- sprintf(ibw_lasterr, "ibv_post_send error %d (%d)\n", >- rc, pconn->wr_sent); >+ snprintf(ibw_lasterr, >+ sizeof(ibw_lasterr), >+ "ibv_post_send error %d (%d)\n", >+ rc, >+ pconn->wr_sent); > goto error; > } > >-- >2.47.3 >
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=18730">View the attachment on a separate page</a>.</b>
View Attachment As Raw
Actions:
View
Attachments on
bug 15918
:
18729
| 18730