[PATCH 2/9 V2] xfsdump: Fix overflow of "question" string in Media_prompt_erase()

[Eric Sandeen <sandeen@xxxxxxxxxxx>]

The string we were sprintf'ing is trivially longer than the array
we allocated for it.

Use asprintf instead, as suggested by Christoph.

Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxx>
---

V2: use asprintf

diff --git a/dump/content.c b/dump/content.c
index ac19021..43756e3 100644
--- a/dump/content.c
+++ b/dump/content.c
@@ -6174,7 +6174,7 @@ static bool_t
 Media_prompt_overwrite( drive_t *drivep )
 {
        fold_t fold;
-       char question[ 100 ];
+       char *question;
        char *preamblestr[ PREAMBLEMAX ];
        size_t preamblecnt;
        char *querystr[ QUERYMAX ];
@@ -6201,9 +6201,8 @@ retry:
 
        /* query: ask if overwrite ok
         */
-       sprintf( question,
-                "overwrite data on media in "
-                "drive %u?\n",
+       asprintf( &question, 
+                "overwrite data on media in drive %u?\n",
                 (unsigned int)drivep->d_index );
        querycnt = 0;
        querystr[ querycnt++ ] = question;
@@ -6250,6 +6249,8 @@ retry:
        dlog_end( postamblestr,
                  postamblecnt );
 
+       free(question);
+
        if ( responseix == sigintix ) {
                if ( cldmgr_stop_requested( )) {
                        return BOOL_FALSE;