Commit 6d7b6905 authored by Krzysztof Karas's avatar Krzysztof Karas Committed by Jim Harris
Browse files

bdevperf: avoid writing outside "out" array boundary 



Currently variables "i" and "k" in config_filename_next()
function may increase at the same speed. When repeating
"for" loop at line 1862 both "i" and "k" are being incremented:
 + i by the for loop,
 + k by the "out[k++]" instruction.
This means that there may be a case, where for loop ends with
"i < BDEVPERF_CONFIG_MAX_FILENAME" condition, as value of "i"
is equal to BDEVPERF_CONFIG_MAX_FILENAME, and at the same time
value of "k" is also equal to BDEVPERF_CONFIG_MAX_FILENAME,
because after writing to out[BDEVPERF_CONFIG_MAX_FILENAME - 1]
element, we increment it one last time.
This results in writing "0" value at line 1873 to memory outside
"out" array boundary.
To amend this problem, compare k against
BDEVPERF_CONFIG_MAX_FILENAME, insted of i.

Change-Id: Ia45778c1f267d2b9dcd676cd9b6c662d09f6f94e
Signed-off-by: default avatarKrzysztof Karas <krzysztof.karas@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/17176


Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
Reviewed-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
parent 982a1bb7

examples/bdev/bdevperf/bdevperf.c

+1 −1
Original line number Diff line number Diff line
@@ -1865,7 +1865,7 @@ config_filename_next(const char *filename, char *out) 
	for (i = 0, k = 0;

	     filename[i] != '\0' &&

	     filename[i] != ':' &&

	     i < BDEVPERF_CONFIG_MAX_FILENAME;

	     k < BDEVPERF_CONFIG_MAX_FILENAME;

	     i++) {

		if (filename[i] == ' ' || filename[i] == '\t') {

			continue;