vmware/splinterdb

Overruning write by sccanf

szsam opened this issue · 0 comments

szsam commented

In the following sscanf calls, '%64s' requires 65 bytes.

ret = sscanf(buffer, "%c %64s", &result[i].cmd, result[i].key);

ret = sscanf(buffer,
"%c %64s %lu\n",
&result[i].cmd,
result[i].key,
&result[i].range_len);

But the length of result[i].key is only 24 bytes.

typedef struct ycsb_op {
char cmd;
char key[YCSB_KEY_SIZE];

#define YCSB_KEY_SIZE 24

Please either modify the sscanf format specifier, or make YCSB_KEY_SIZE larger.