[ofa-general] [PATCH] osm: source and destination strings overlap when using sprintf()

[Yevgeny Kliteynik]

Hi Hal,

Fixing a problematic usage of sprintf() in osm_helper.c:

When using sprintf(), source and destination strings should
not overlap, otherwise the function behavior is undefined.

Please apply to ofed_1_2 and to master.

Thanks.

-- Yevgeny

Signed-off-by: Yevgeny Kliteynik <kliteyn at dev.mellanox.co.il>
---
 osm/opensm/osm_helper.c |   47 ++++++++++++++++++++++++++++++++++-------------
 1 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/osm/opensm/osm_helper.c b/osm/opensm/osm_helper.c
index 14474e7..1b43ba2 100644
--- a/osm/opensm/osm_helper.c
+++ b/osm/opensm/osm_helper.c
@@ -1147,6 +1147,7 @@ osm_dump_multipath_record(
 {
   int i;
   char buf_line[1024];
+  char tmp_buf_line[1024];
   ib_gid_t const *p_gid;
 
   if( osm_log_is_active( p_log, log_level ) )
@@ -1157,10 +1158,11 @@ osm_dump_multipath_record(
     {
       for (i = 0; i < p_mpr->sgid_count; i++)
       {
-        sprintf( buf_line, "%s\t\t\t\tsgid%02d.................."
+        sprintf( tmp_buf_line, "\t\t\t\tsgid%02d.................."
                  "0x%016" PRIx64 " : 0x%016" PRIx64 "\n",
-                 buf_line, i + 1, cl_ntoh64( p_gid->unicast.prefix ),
+                 i + 1, cl_ntoh64( p_gid->unicast.prefix ),
                  cl_ntoh64( p_gid->unicast.interface_id ) );
+        strcat( buf_line, tmp_buf_line );
         p_gid++;
       }
     }
@@ -1168,10 +1170,11 @@ osm_dump_multipath_record(
     {
       for (i = 0; i < p_mpr->dgid_count; i++)
       {
-        sprintf( buf_line, "%s\t\t\t\tdgid%02d.................."
+        sprintf( tmp_buf_line, "\t\t\t\tdgid%02d.................."
                  "0x%016" PRIx64 " : 0x%016" PRIx64 "\n",
-                 buf_line, i + 1, cl_ntoh64( p_gid->unicast.prefix ),
+                 i + 1, cl_ntoh64( p_gid->unicast.prefix ),
                  cl_ntoh64( p_gid->unicast.interface_id ) );
+        strcat( buf_line, tmp_buf_line );
         p_gid++;
       }
     }
@@ -1652,13 +1655,17 @@ osm_dump_pkey_block(
 {
   int i;
   char buf_line[1024];
+  char tmp_buf_line[1024];
 
   if( osm_log_is_active( p_log, log_level ) )
   {
     buf_line[0] = '\0';
     for (i = 0; i < 32; i++)
-      sprintf( buf_line,"%s 0x%04x |",
-               buf_line, cl_ntoh16(p_pkey_tbl->pkey_entry[i]));
+    {
+      sprintf( tmp_buf_line," 0x%04x |",
+               cl_ntoh16(p_pkey_tbl->pkey_entry[i]));
+      strcat( buf_line, tmp_buf_line );
+    }
 
     osm_log( p_log, log_level,
              "P_Key table dump:\n"
@@ -1687,16 +1694,23 @@ osm_dump_slvl_map_table(
   uint8_t i;
   char buf_line1[1024];
   char buf_line2[1024];
+  char tmp_buf_line[1024];
 
   if( osm_log_is_active( p_log, log_level ) )
   {
     buf_line1[0] = '\0';
     buf_line2[0] = '\0';
     for (i = 0; i < 16; i++)
-      sprintf( buf_line1,"%s %-2u |", buf_line1, i);
+    {
+      sprintf( tmp_buf_line," %-2u |", i);
+      strcat( buf_line1, tmp_buf_line );
+    }
     for (i = 0; i < 16; i++)
-      sprintf( buf_line2,"%s0x%01X |",
-               buf_line2, ib_slvl_table_get(p_slvl_tbl, i));
+    {
+      sprintf( tmp_buf_line,"0x%01X |",
+               ib_slvl_table_get(p_slvl_tbl, i));
+      strcat( buf_line2, tmp_buf_line );
+    }
     osm_log( p_log, log_level,
              "SLtoVL dump:\n"
              "\t\t\tport_guid............0x%016" PRIx64 "\n"
@@ -1724,17 +1738,24 @@ osm_dump_vl_arb_table(
   int i;
   char buf_line1[1024];
   char buf_line2[1024];
+  char tmp_buf_line[1024];
 
   if( osm_log_is_active( p_log, log_level ) )
   {
     buf_line1[0] = '\0';
     buf_line2[0] = '\0';
     for (i = 0; i < 32; i++)
-      sprintf( buf_line1,"%s 0x%01X |",
-               buf_line1, p_vla_tbl->vl_entry[i].vl);
+    {
+      sprintf( tmp_buf_line," 0x%01X |",
+               p_vla_tbl->vl_entry[i].vl);
+      strcat( buf_line1, tmp_buf_line );
+    }
     for (i = 0; i < 32; i++)
-      sprintf( buf_line2,"%s 0x%01X |",
-               buf_line2, p_vla_tbl->vl_entry[i].weight);
+    {
+      sprintf( tmp_buf_line," 0x%01X |",
+               p_vla_tbl->vl_entry[i].weight);
+      strcat( buf_line2, tmp_buf_line );
+    }
     osm_log( p_log, log_level,
              "VlArb dump:\n"
              "\t\t\tport_guid...........0x%016" PRIx64 "\n"
-- 
1.4.4.1.GIT