tacit/minix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

make sure name_len is not negative

Browse Source 
This change adds a check to make sure name_len is not negative. This change was made to prevent memory corruption from occurring if name_len is negative.
This commit is contained in:
Ilja van Sprundel 2019-10-03 15:42:33 +02:00 committed by GitHub
parent bf0147da26
commit ad9475f6bf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
minix/servers/vfs/path.c
View File

@ -621,7 +621,7 @@ get_name(struct vnode *dirp, struct vnode *entry, char ename[NAME_MAX + 1])
cur = (struct dirent *) (buf + consumed); cur = (struct dirent *) (buf + consumed);
name_len = cur->d_reclen - offsetof(struct dirent, d_name) - 1; name_len = cur->d_reclen - offsetof(struct dirent, d_name) - 1;
if(cur->d_name + name_len+1 > &buf[sizeof(buf)]) if(name_len < 0 || cur->d_name + name_len+1 > &buf[sizeof(buf)])
return(EINVAL); /* Rubbish in dir entry */ return(EINVAL); /* Rubbish in dir entry */
if (entry->v_inode_nr == cur->d_fileno) { if (entry->v_inode_nr == cur->d_fileno) {
/* found the entry we were looking for */ /* found the entry we were looking for */