lkml.org 
[lkml]   [2013]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v1] seq_file: Fix overflow condition in seq_commit
On Tue, Aug 20, 2013 at 12:51:56PM +0530, Arun KS wrote:

> d_path expects the pathname to be less than 64 bytes. If its more than
> 64, it returns -ENAMETOOLONG.

?!?!? d_path() does not expect anything of that sort - it can very
well produce names much longer, without ENAMETOOLONG.

> char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen,
> const char *fmt, ...)
> {
> va_list args;
> char temp[64];
> int sz;
>
> va_start(args, fmt);
> sz = vsnprintf(temp, sizeof(temp), fmt, args) + 1;
> va_end(args);
>
> if (sz > sizeof(temp) || sz > buflen)
> return ERR_PTR(-ENAMETOOLONG);
>
> buffer += buflen - sz;
> return memcpy(buffer, temp, sz);
> }

Aha. _That_ is a bug, all right - dynamic_dname() is simply not suitable
for that kind of uses. ashmem.c is certainly abusing shmem_file_setup();
feeding that kind of mess as dentry name is a Bad Idea(tm). Anyway,
I'd suggest this for a fix:

va_list args;
size_t sz;
va_start(args, fmt);
sz = vsnprintf(NULL, 0, fmt, args) + 1;
va_end(args);
if (sz > buflen)
return ERR_PTR(-ENAMETOOLONG);
va_start(args, fmt);
buffer += buflen - sz;
vsprintf(buffer, fmt, args);
va_end(args);
return buffer;

Either right in dynamic_dname(), or as possibly_fucking_long_dname(),
to be used by shmem.c...


\
 
 \ /
  Last update: 2013-08-20 09:41    [W:0.070 / U:0.616 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site