[PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

In the iet and datacore prioritizers, multipath was using sscanf to get
a string for a 255 byte buffer, without limiting the size of the string.
This could result in a buffer overflow, if there was a bad value in
multipath.conf.

Signed-off-by: Benjamin Marzinski <[email protected]>
---

Note:
This patch applies on top of Martin's ("libmultipath: iet prioritizer:
obtain PATH_ID from udev") commit, from the "tip" branch.

 libmultipath/prioritizers/datacore.c | 6 +++---
 libmultipath/prioritizers/iet.c      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/libmultipath/prioritizers/datacore.c b/libmultipath/prioritizers/datacore.c
index ab813a0e..a7c2ae3e 100644
--- a/libmultipath/prioritizers/datacore.c
+++ b/libmultipath/prioritizers/datacore.c
@@ -49,11 +49,11 @@ int datacore_prio (const char *dev, int sg_fd, char * args,
 		return 0;
 	}
 
-	if (sscanf(args, "timeout=%i preferredsds=%s",
+	if (sscanf(args, "timeout=%i preferredsds=%254s",
 		   (int *)&timeout_ms, preferredsds) == 2) {}
-	else if (sscanf(args, "preferredsds=%s timeout=%i",
+	else if (sscanf(args, "preferredsds=%254s timeout=%i",
 			preferredsds, (int *)&timeout_ms) == 2) {}
-	else if (sscanf(args, "preferredsds=%s",
+	else if (sscanf(args, "preferredsds=%254s",
 			preferredsds) == 1) {}
 	else {
 		dc_log(0, "unexpected prio_args format");
diff --git a/libmultipath/prioritizers/iet.c b/libmultipath/prioritizers/iet.c
index 97d35192..cddf29c6 100644
--- a/libmultipath/prioritizers/iet.c
+++ b/libmultipath/prioritizers/iet.c
@@ -101,7 +101,7 @@ int iet_prio(struct udev_device *udev, char *args)
 		return 0;
 	}
 	// check if args format is OK
-	if (sscanf(args, "preferredip=%s", preferredip) != 1) {
+	if (sscanf(args, "preferredip=%254s", preferredip) != 1) {
 		if (!arg_logged) {
 			dc_log(2, "unexpected prio_args format");
 			arg_logged = true;
-- 
2.53.0