From 583e43130d1aa3d789231b799f3f5c632877a4ee Mon Sep 17 00:00:00 2001 From: Greg Burd Date: Mon, 22 Jun 2026 16:37:34 -0400 Subject: [PATCH] fix(hotbackup): bound home-path construction with snprintf db_hotbackup built the probe path with sprintf(buf, "%s/%s", home, home) into a fixed DB_MAXPATHLEN stack buffer. A -h argument longer than ~DB_MAXPATHLEN/2 overflowed buf. This is a local CLI utility run by the operator (not remotely reachable), so the impact is limited, but the unbounded write is a real defect. Use snprintf with sizeof(buf), matching the existing bounded call later in the same function. With an over-long -h the path now truncates and the subsequent path lookup fails cleanly (File name too long) instead of smashing the stack. Applied to both the canonical util/ source and the checked-in build_vxworks/ copy. --- build_vxworks/util/db_hotbackup.c | 2 +- util/db_hotbackup.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build_vxworks/util/db_hotbackup.c b/build_vxworks/util/db_hotbackup.c index bc8b6e384..beadcab21 100644 --- a/build_vxworks/util/db_hotbackup.c +++ b/build_vxworks/util/db_hotbackup.c @@ -452,7 +452,7 @@ db_hotbackup_env_init(dbenvp, home, log_dirp, data_dirp, passwd, which, verbose) * trim the home directory from the data directory * passed in. */ - (void) sprintf(buf, "%s/%s", home, home); + (void)snprintf(buf, sizeof(buf), "%s/%s", home, home); homehome = 0; (void)__os_exists(dbenv->env, buf, &homehome); diff --git a/util/db_hotbackup.c b/util/db_hotbackup.c index 08dddc884..2b3d20940 100644 --- a/util/db_hotbackup.c +++ b/util/db_hotbackup.c @@ -437,7 +437,7 @@ env_init(dbenvp, home, log_dirp, data_dirp, passwd, which, verbose) * trim the home directory from the data directory * passed in. */ - (void) sprintf(buf, "%s/%s", home, home); + (void)snprintf(buf, sizeof(buf), "%s/%s", home, home); homehome = 0; (void)__os_exists(dbenv->env, buf, &homehome);