7afb6d8fa8
Theoretically possible that "%pg" will take all room for the j_devname and hence the "-%lu" will go outside the boundary due to unconditional sprintf() in use. To make this code more robust, replace two sequential s*printf():s by a single call and then replace forbidden character. It's possible to do this way, because '/' won't ever be in the result of "-%lu". Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230605170553.7835-2-andriy.shevchenko@linux.intel.com |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| checkpoint.c | ||
| commit.c | ||
| journal.c | ||
| recovery.c | ||
| revoke.c | ||
| transaction.c | ||