We can not assume "'path' + 'ctx->fs_root'" must be less than MAX_PATH, so need use snprintf() instead of sprintf().
And also recommend to use ARRAY_SIZE instead of hard code macro for an array size in snprintf(). Signed-off-by: Chen Gang <gang.chen.5...@gmail.com> --- hw/9pfs/virtio-9p-local.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/hw/9pfs/virtio-9p-local.c b/hw/9pfs/virtio-9p-local.c index fc93e9e..44a0380 100644 --- a/hw/9pfs/virtio-9p-local.c +++ b/hw/9pfs/virtio-9p-local.c @@ -159,7 +159,7 @@ static int local_create_mapped_attr_dir(FsContext *ctx, const char *path) char attr_dir[PATH_MAX]; char *tmp_path = g_strdup(path); - snprintf(attr_dir, PATH_MAX, "%s/%s/%s", + snprintf(attr_dir, ARRAY_SIZE(attr_dir), "%s/%s/%s", ctx->fs_root, dirname(tmp_path), VIRTFS_META_DIR); err = mkdir(attr_dir, 0700); @@ -898,7 +898,8 @@ static int local_remove(FsContext *ctx, const char *path) * directory */ if (S_ISDIR(stbuf.st_mode)) { - sprintf(buffer, "%s/%s/%s", ctx->fs_root, path, VIRTFS_META_DIR); + snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s", + ctx->fs_root, path, VIRTFS_META_DIR); err = remove(buffer); if (err < 0 && errno != ENOENT) { /* @@ -1033,8 +1034,8 @@ static int local_unlinkat(FsContext *ctx, V9fsPath *dir, * If directory remove .virtfs_metadata contained in the * directory */ - sprintf(buffer, "%s/%s/%s", ctx->fs_root, - fullname.data, VIRTFS_META_DIR); + snprintf(buffer, ARRAY_SIZE(buffer), "%s/%s/%s", ctx->fs_root, + fullname.data, VIRTFS_META_DIR); ret = remove(buffer); if (ret < 0 && errno != ENOENT) { /* -- 1.7.11.7