From 569c2da787a8f23460c93b98003c9fea246fab29 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <[email protected]>
Date: Thu, 18 Jul 2024 12:58:23 +0200
Subject: [PATCH 58/85] ras-report: fix coding style and string fill issues

Don't use unsafe sprintf(). Instead, re-implement the logic in
a way that buffer overflows won't occur.

While here, also avoid lines longer than 80 columns when possible.

Signed-off-by: Mauro Carvalho Chehab <[email protected]>
---
 ras-report.c | 138 +++++++++++++++++++++++++++++++--------------------
 1 file changed, 85 insertions(+), 53 deletions(-)

diff --git a/ras-report.c b/ras-report.c
index 0ddf86f..0f23424 100644
--- a/ras-report.c
+++ b/ras-report.c
@@ -64,22 +64,23 @@ static int commit_report_basic(int sockfd)
 	/*
 	 * ABRT server protocol
 	 */
-	sprintf(buf, "PUT / HTTP/1.1\r\n\r\n");
+	snprintf(buf, INPUT_BUFFER_SIZE, "PUT / HTTP/1.1\r\n\r\n");
 	rc = write(sockfd, buf, strlen(buf));
 	if (rc < strlen(buf))
 		return -1;
 
-	sprintf(buf, "PID=%d", (int)getpid());
+	snprintf(buf, INPUT_BUFFER_SIZE, "PID=%d", (int)getpid());
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		return -1;
 
-	sprintf(buf, "EXECUTABLE=/boot/vmlinuz-%s", un.release);
+	snprintf(buf, INPUT_BUFFER_SIZE, "EXECUTABLE=/boot/vmlinuz-%s",
+		 un.release);
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		return -1;
 
-	sprintf(buf, "TYPE=%s", "ras");
+	snprintf(buf, INPUT_BUFFER_SIZE, "TYPE=%s", "ras");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		return -1;
@@ -89,12 +90,17 @@ static int commit_report_basic(int sockfd)
 
 static int set_mc_event_backtrace(char *buf, struct ras_mc_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"error_count=%d\n"
 		"error_type=%s\n"
@@ -122,19 +128,22 @@ static int set_mc_event_backtrace(char *buf, struct ras_mc_event *ev)
 		ev->syndrome,
 		ev->driver_detail);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
 static int set_mce_event_backtrace(char *buf, struct mce_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"bank_name=%s\n"
 		"error_msg=%s\n"
@@ -182,19 +191,22 @@ static int set_mce_event_backtrace(char *buf, struct mce_event *ev)
 		ev->bank,
 		ev->cpuvendor);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
 static int set_aer_event_backtrace(char *buf, struct ras_aer_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"error_type=%s\n"
 		"dev_name=%s\n"
@@ -204,19 +216,22 @@ static int set_aer_event_backtrace(char *buf, struct ras_aer_event *ev)
 		ev->dev_name,
 		ev->msg);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
 static int set_non_standard_event_backtrace(char *buf, struct ras_non_standard_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"severity=%s\n"
 		"length=%d\n",
@@ -224,19 +239,22 @@ static int set_non_standard_event_backtrace(char *buf, struct ras_non_standard_e
 		ev->severity,
 		ev->length);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
 static int set_arm_event_backtrace(char *buf, struct ras_arm_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"error_count=%d\n"
 		"affinity=%d\n"
@@ -252,19 +270,22 @@ static int set_arm_event_backtrace(char *buf, struct ras_arm_event *ev)
 		ev->running_state,
 		ev->psci_state);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
 static int set_devlink_event_backtrace(char *buf, struct devlink_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"bus_name=%s\n"
 		"dev_name=%s\n"
@@ -278,19 +299,22 @@ static int set_devlink_event_backtrace(char *buf, struct devlink_event *ev)
 		ev->reporter_name,
 		ev->msg);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
 static int set_diskerror_event_backtrace(char *buf, struct diskerror_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"dev=%s\n"
 		"sector=%llu\n"
@@ -306,19 +330,22 @@ static int set_diskerror_event_backtrace(char *buf, struct diskerror_event *ev)
 		ev->rwbs,
 		ev->cmd);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
 static int set_mf_event_backtrace(char *buf, struct ras_mf_event *ev)
 {
-	char bt_buf[MAX_BACKTRACE_SIZE];
+	unsigned int size = MAX_BACKTRACE_SIZE;
 
 	if (!buf || !ev)
 		return -1;
 
-	sprintf(bt_buf, "BACKTRACE="
+	while (*buf && size > 0) {
+		buf++;
+		size--;
+	}
+
+	snprintf(buf, size, "BACKTRACE="
 		"timestamp=%s\n"
 		"pfn=%s\n"
 		"page_type=%s\n"
@@ -328,8 +355,6 @@ static int set_mf_event_backtrace(char *buf, struct ras_mf_event *ev)
 		ev->page_type,
 		ev->action_result);
 
-	strcat(buf, bt_buf);
-
 	return 0;
 }
 
@@ -422,12 +447,12 @@ int ras_report_mc_event(struct ras_events *ras, struct ras_mc_event *ev)
 	if (rc < 0)
 		goto mc_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-mc");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s", "rasdaemon-mc");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto mc_fail;
 
-	sprintf(buf, "REASON=%s", "EDAC driver report problem");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s", "EDAC driver report problem");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto mc_fail;
@@ -465,12 +490,13 @@ int ras_report_aer_event(struct ras_events *ras, struct ras_aer_event *ev)
 	if (rc < 0)
 		goto aer_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-aer");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s", "rasdaemon-aer");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto aer_fail;
 
-	sprintf(buf, "REASON=%s", "PCIe AER driver report problem");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s",
+		 "PCIe AER driver report problem");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto aer_fail;
@@ -488,7 +514,8 @@ aer_fail:
 	return -1;
 }
 
-int ras_report_non_standard_event(struct ras_events *ras, struct ras_non_standard_event *ev)
+int ras_report_non_standard_event(struct ras_events *ras,
+				  struct ras_non_standard_event *ev)
 {
 	char buf[MAX_MESSAGE_SIZE];
 	int sockfd = 0;
@@ -508,12 +535,14 @@ int ras_report_non_standard_event(struct ras_events *ras, struct ras_non_standar
 	if (rc < 0)
 		goto non_standard_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-non-standard");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s",
+		 "rasdaemon-non-standard");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto non_standard_fail;
 
-	sprintf(buf, "REASON=%s", "Unknown CPER section problem");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s",
+		 "Unknown CPER section problem");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto non_standard_fail;
@@ -548,12 +577,12 @@ int ras_report_arm_event(struct ras_events *ras, struct ras_arm_event *ev)
 	if (rc < 0)
 		goto arm_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-arm");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s", "rasdaemon-arm");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto arm_fail;
 
-	sprintf(buf, "REASON=%s", "ARM CPU report problem");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s", "ARM CPU report problem");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto arm_fail;
@@ -589,12 +618,13 @@ int ras_report_mce_event(struct ras_events *ras, struct mce_event *ev)
 	if (rc < 0)
 		goto mce_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-mce");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s", "rasdaemon-mce");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto mce_fail;
 
-	sprintf(buf, "REASON=%s", "Machine Check driver report problem");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s",
+		 "Machine Check driver report problem");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto mce_fail;
@@ -633,12 +663,13 @@ int ras_report_devlink_event(struct ras_events *ras, struct devlink_event *ev)
 	if (rc < 0)
 		goto devlink_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-devlink");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s", "rasdaemon-devlink");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto devlink_fail;
 
-	sprintf(buf, "REASON=%s", "devlink health report problem");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s",
+		 "devlink health report problem");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto devlink_fail;
@@ -677,12 +708,12 @@ int ras_report_diskerror_event(struct ras_events *ras, struct diskerror_event *e
 	if (rc < 0)
 		goto diskerror_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-diskerror");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s", "rasdaemon-diskerror");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto diskerror_fail;
 
-	sprintf(buf, "REASON=%s", "disk I/O error");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s", "disk I/O error");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto diskerror_fail;
@@ -720,12 +751,13 @@ int ras_report_mf_event(struct ras_events *ras, struct ras_mf_event *ev)
 	if (rc < 0)
 		goto mf_fail;
 
-	sprintf(buf, "ANALYZER=%s", "rasdaemon-memory_failure");
+	snprintf(buf, MAX_MESSAGE_SIZE, "ANALYZER=%s",
+		 "rasdaemon-memory_failure");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto mf_fail;
 
-	sprintf(buf, "REASON=%s", "memory failure problem");
+	snprintf(buf, MAX_MESSAGE_SIZE, "REASON=%s", "memory failure problem");
 	rc = write(sockfd, buf, strlen(buf) + 1);
 	if (rc < strlen(buf) + 1)
 		goto mf_fail;
-- 
2.33.1