The snprintf to format an xstat name could overflow if called with a long rte_vhost_stat_name. Check if that happens and warn.
Signed-off-by: Stephen Hemminger <[email protected]> --- lib/vhost/vhost.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c index 416f082dca..540f4e0635 100644 --- a/lib/vhost/vhost.c +++ b/lib/vhost/vhost.c @@ -2200,6 +2200,7 @@ rte_vhost_vring_stats_get_names(int vid, uint16_t queue_id, { struct virtio_net *dev = get_device(vid); unsigned int i; + int ret; if (dev == NULL) return -1; @@ -2213,10 +2214,15 @@ rte_vhost_vring_stats_get_names(int vid, uint16_t queue_id, if (name == NULL || size < VHOST_NB_VQ_STATS) return VHOST_NB_VQ_STATS; - for (i = 0; i < VHOST_NB_VQ_STATS; i++) - snprintf(name[i].name, sizeof(name[i].name), "%s_q%u_%s", - (queue_id & 1) ? "rx" : "tx", - queue_id / 2, vhost_vq_stat_strings[i].name); + for (i = 0; i < VHOST_NB_VQ_STATS; i++) { + ret = snprintf(name[i].name, sizeof(name[i].name), "%s_q%u_%s", + (queue_id & 1) ? "rx" : "tx", + queue_id / 2, vhost_vq_stat_strings[i].name); + if (ret >= (int)sizeof(name[0].name)) + VHOST_CONFIG_LOG("device", NOTICE, "truncated xstat '%s_q%u_%s'", + (queue_id & 1) ? "rx" : "tx", + queue_id / 2, vhost_vq_stat_strings[i].name); + } return VHOST_NB_VQ_STATS; } -- 2.51.0
