libbpf-tools: fix uprobe helper possible overflow

get_pid_lib_path didn't use path_sz in sscanf, so it may cause
buffer overflow when path_sz is smaller than the real lib path.
For exmample: "get_pid_lib_path(1, "c", minpath, 1)" may bring
error.

libbpf-tools/uprobe_helpers.c

@@ -56,6 +56,7 @@ int get_pid_lib_path(pid_t pid, const char *lib, char *path, size_t path_sz)
  char *p;
  char proc_pid_maps[32];
  char line_buf[1024];
+ char path_buf[1024];
 
  if (snprintf(proc_pid_maps, sizeof(proc_pid_maps), "/proc/%d/maps", pid)
  >= sizeof(proc_pid_maps)) {
@@ -68,10 +69,10 @@ int get_pid_lib_path(pid_t pid, const char *lib, char *path, size_t path_sz)
  return -1;
  }
  while (fgets(line_buf, sizeof(line_buf), maps)) {
- if (sscanf(line_buf, "%*x-%*x %*s %*x %*s %*u %s", path) != 1)
+ if (sscanf(line_buf, "%*x-%*x %*s %*x %*s %*u %s", path_buf) != 1)
  continue;
  /* e.g. /usr/lib/x86_64-linux-gnu/libc-2.31.so */
- p = strrchr(path, '/');
+ p = strrchr(path_buf, '/');
  if (!p)
  continue;
  if (strncmp(p, "/lib", 4))
@@ -83,7 +84,11 @@ int get_pid_lib_path(pid_t pid, const char *lib, char *path, size_t path_sz)
  /* libraries can have - or . after the name */
  if (*p != '.' && *p != '-')
  continue;
-
+ if (strnlen(path_buf, 1024) >= path_sz) {
+ warn("path size too small\n");
+ return -1;
+ }
+ strcpy(path, path_buf);
  fclose(maps);
  return 0;
  }