[PATCH 2/9 V2] xfsdump: Fix overflow of "question" string in Media_prompt_erase()

[Eric Sandeen]

The string we were sprintf'ing is trivially longer than the array
we allocated for it.

Use asprintf instead, as suggested by Christoph.

Signed-off-by: Eric Sandeen <sandeen at redhat.com>
---

V2: use asprintf

diff --git a/dump/content.c b/dump/content.c
index ac19021..43756e3 100644
--- a/dump/content.c
+++ b/dump/content.c
@@ -6174,7 +6174,7 @@ static bool_t
 Media_prompt_overwrite( drive_t *drivep )
 {
 	fold_t fold;
-	char question[ 100 ];
+	char *question;
 	char *preamblestr[ PREAMBLEMAX ];
 	size_t preamblecnt;
 	char *querystr[ QUERYMAX ];
@@ -6201,9 +6201,8 @@ retry:
 
 	/* query: ask if overwrite ok
 	 */
-	sprintf( question,
-		 "overwrite data on media in "
-		 "drive %u?\n",
+	asprintf( &question, 
+		 "overwrite data on media in drive %u?\n",
 		 (unsigned int)drivep->d_index );
 	querycnt = 0;
 	querystr[ querycnt++ ] = question;
@@ -6250,6 +6249,8 @@ retry:
 	dlog_end( postamblestr,
 		  postamblecnt );
 
+	free(question);
+
 	if ( responseix == sigintix ) {
 		if ( cldmgr_stop_requested( )) {
 			return BOOL_FALSE;