dm: reject trailing characters in sccanf input

Device mapper uses sscanf to convert arguments to numbers. The problem is that
the way we use it ignores additional unmatched characters in the scanned string.

For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
but also it will match number with some garbage appended, like "123abc".

As a result, device mapper accepts garbage after some numbers. For example
the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
will pass without an error.

This patch fixes all sscanf uses in device mapper. It appends "%c" with
a pointer to a dummy character variable to every sscanf statement.

The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
only if string is a null-terminated number (optionally preceded by some
whitespace characters). If there is some character appended after the number,
sscanf matches "%c", writes the character to the dummy variable and returns 2.
We check the return value for 1 and consequently reject numbers with some
garbage appended.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index a3d1e18317f4..2e227fbf1622 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -463,10 +463,11 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
         struct dm_dev_internal *dd;
         unsigned int major, minor;
         struct dm_table *t = ti->table;
+        char dummy;
 
         BUG_ON(!t);
 
-        if (sscanf(path, "%u:%u", &major, &minor) == 2) {
+        if (sscanf(path, "%u:%u%c", &major, &minor, &dummy) == 2) {
                 /* Extract the major/minor numbers */
                 dev = MKDEV(major, minor);
                 if (MAJOR(dev) != major || MINOR(dev) != minor)
@@ -841,9 +842,10 @@ static int validate_next_arg(struct dm_arg *arg, struct dm_arg_set *arg_set,
                              unsigned *value, char **error, unsigned grouped)
 {
         const char *arg_str = dm_shift_arg(arg_set);
+        char dummy;
 
         if (!arg_str ||
-            (sscanf(arg_str, "%u", value) != 1) ||
+            (sscanf(arg_str, "%u%c", value, &dummy) != 1) ||
             (*value < arg->min) ||
             (*value > arg->max) ||
             (grouped && arg_set->argc < *value)) {