From 9afe2e92dfbaf108f12e2807bb1dbabe012d6a09 Mon Sep 17 00:00:00 2001 From: Farzan Aman Khan Date: Mon, 30 Mar 2026 15:38:39 +0530 Subject: [PATCH] zdtm/ipc: use snprintf and bounded writes for sysctl payloads Build sysctl payloads with snprintf() and check for error/truncation before writing. Use the returned payload length for write() instead of fixed-size writes, so only formatted bytes are written. On snprintf failure/truncation, print an explicit error message and return -1. On write/open helper failures, return -1 because callers only use success/failure and pr_perror() already logs errno. Signed-off-by: Farzan Aman Khan --- test/zdtm/static/ipc_namespace.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/test/zdtm/static/ipc_namespace.c b/test/zdtm/static/ipc_namespace.c index b985862f0..3fb3e650c 100644 --- a/test/zdtm/static/ipc_namespace.c +++ b/test/zdtm/static/ipc_namespace.c @@ -221,8 +221,13 @@ static int rand_ipc_sysctl(char *name, unsigned int val) pr_perror("Can't open %s", name); return -1; } - sprintf(buf, "%d\n", val); - ret = write(fd, buf, strlen(buf)); + ret = snprintf(buf, sizeof(buf), "%u\n", val); + if (ret < 0 || ret >= sizeof(buf)) { + pr_err("Can't format %u for %s\n", val, name); + close(fd); + return -1; + } + ret = write(fd, buf, ret); if (ret < 0) { pr_perror("Can't write %u into %s", val, name); close(fd); @@ -246,9 +251,14 @@ static int rand_ipc_sem(void) pr_perror("Can't open %s", name); return -1; } - sprintf(buf, "%d %d %d %d\n", (unsigned)lrand48(), (unsigned)lrand48(), (unsigned)lrand48(), - (unsigned)lrand48() % MAX_MNI); - ret = write(fd, buf, 128); + ret = snprintf(buf, sizeof(buf), "%u %u %u %u\n", (unsigned)lrand48(), (unsigned)lrand48(), + (unsigned)lrand48(), (unsigned)lrand48() % MAX_MNI); + if (ret < 0 || ret >= sizeof(buf)) { + pr_err("Can't format semaphore sysctl payload for %s\n", name); + close(fd); + return -1; + } + ret = write(fd, buf, ret); if (ret < 0) { pr_perror("Can't write %s", name); close(fd);