Limit scanf to actual field length 90/240890/1 accepted/tizen/unified/20200813.015355 submit/tizen/20200812.130123
authorKarol Lewandowski <k.lewandowsk@samsung.com>
Wed, 12 Aug 2020 10:56:54 +0000 (12:56 +0200)
committerKarol Lewandowski <k.lewandowsk@samsung.com>
Wed, 12 Aug 2020 10:56:54 +0000 (12:56 +0200)
Change-Id: I45a029e070d392b349e477895d479d3bc27c522b

src/system-recovery.c
src/system-recovery.h.in

index 40d512874401270b558e3ca83f7a836975b0f1cb..c91dfda5bb8933b78e402f9daa5a1fe09a5d229c 100644 (file)
@@ -159,7 +159,12 @@ static int read_config_file(struct image **image_list)
 
        // Store image configuration
        _I("=== Image list start ===");
-       while ((ret = fscanf(fp, "%s %s %s\n", ibuf.label, ibuf.basename, ibuf.devpath) != EOF)) {
+       while ((ret = fscanf(fp, "%" IMAGE_FIELD_LENGTH_STR "s"
+                                "%" IMAGE_FIELD_LENGTH_STR "s"
+                                "%" IMAGE_FIELD_LENGTH_STR "s\n",
+                                ibuf.label,
+                                ibuf.basename,
+                                ibuf.devpath) != EOF)) {
                _I("Label(%s), Basename(%s), Devpath(%s)", ibuf.label, ibuf.basename, ibuf.devpath);
 
                snprintf(path, sizeof(path), "%s/%s", RECOVERY_IMAGE_MOUNTPOINT, ibuf.basename);
index 7609d59bbbbd7510f572692a9b798a8f59130b39..22da077150879bb3244cefa13a795992fa53eaa7 100644 (file)
@@ -24,6 +24,10 @@ do { \
 #define PROGRESS_FILE_PATH "/tmp/recovery_progress"
 
 #define FIELD_LENGTH 32
+#define STRINGIFY(x) __STRINGIFY(x)
+#define __STRINGIFY(x) #x
+
+#define IMAGE_FIELD_LENGTH_STR STRINGIFY(FIELD_LENGTH)
 
 struct image {
        char label[FIELD_LENGTH];