6805103 ucodeadm dies due to memory corruption on AMD platforms

1 files changed, 14 insertions, 13 deletions

diff --git a/usr/src/cmd/ucodeadm/ucodeadm.c b/usr/src/cmd/ucodeadm/ucodeadm.c
index b4544cb1af..1ff85bcf0d 100644
--- a/usr/src/cmd/ucodeadm/ucodeadm.c
+++ b/usr/src/cmd/ucodeadm/ucodeadm.c
@@ -237,26 +237,27 @@ ucode_gen_files_amd(uint8_t *buf, int size, char *path)
 {
 	/* LINTED: pointer alignment */
 	uint32_t *ptr = (uint32_t *)buf;
-	int plen = strlen(path);
+	char common_path[PATH_MAX];
 	int fd, count, counter;
 	ucode_header_amd_t *uh;
 	int last_cpu_rev = 0;
 
+
 	/* write container file */
-	(void) snprintf(path + plen, PATH_MAX - plen, "/container");
+	(void) snprintf(common_path, PATH_MAX, "%s/%s", path, "container");
 
-	dprintf("path = %s\n", path);
-	fd = open(path, O_WRONLY | O_CREAT | O_TRUNC,
+	dprintf("path = %s\n", common_path);
+	fd = open(common_path, O_WRONLY | O_CREAT | O_TRUNC,
 	    S_IRUSR | S_IRGRP | S_IROTH);
 
 	if (fd == -1) {
-		ucode_perror(path, EM_SYS);
+		ucode_perror(common_path, EM_SYS);
 		return (EM_SYS);
 	}
 
 	if (write(fd, buf, size) != size) {
 		(void) close(fd);
-		ucode_perror(path, EM_SYS);
+		ucode_perror(common_path, EM_SYS);
 		return (EM_SYS);
 	}
 
@@ -268,21 +269,22 @@ ucode_gen_files_amd(uint8_t *buf, int size, char *path)
 	count = *ptr++; size -= 4;
 
 	/* equivalence table uses special name */
-	(void) snprintf(path + plen, PATH_MAX - plen, "/equivalence-table");
+	(void) snprintf(common_path, PATH_MAX, "%s/%s", path,
+	    "equivalence-table");
 
 	for (;;) {
-		dprintf("path = %s\n", path);
-		fd = open(path, O_WRONLY | O_CREAT | O_TRUNC,
+		dprintf("path = %s\n", common_path);
+		fd = open(common_path, O_WRONLY | O_CREAT | O_TRUNC,
 		    S_IRUSR | S_IRGRP | S_IROTH);
 
 		if (fd == -1) {
-			ucode_perror(path, EM_SYS);
+			ucode_perror(common_path, EM_SYS);
 			return (EM_SYS);
 		}
 
 		if (write(fd, ptr, count) != count) {
 			(void) close(fd);
-			ucode_perror(path, EM_SYS);
+			ucode_perror(common_path, EM_SYS);
 			return (EM_SYS);
 		}
 
@@ -303,8 +305,7 @@ ucode_gen_files_amd(uint8_t *buf, int size, char *path)
 			counter = 0;
 		}
 
-		path[plen] = '\0';
-		(void) snprintf(path + plen, PATH_MAX - plen, "/%04X-%02X",
+		(void) snprintf(common_path, PATH_MAX, "%s/%04X-%02X", path,
 		    uh->uh_cpu_rev, counter++);
 	}
 }