Module Name: src
Committed By: maya
Date: Fri Aug 4 07:27:42 UTC 2017
Modified Files:
src/sys/ufs/lfs: ulfs_vnops.c
Log Message:
fix buffer overflow/KASSERT when cookies are supplied
lfs no longer uses the ffs-style struct direct, use the correct minimum
size
from dholland
XXX more wrong
To generate a diff of this commit:
cvs rdiff -u -r1.49 -r1.50 src/sys/ufs/lfs/ulfs_vnops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/ufs/lfs/ulfs_vnops.c
diff -u src/sys/ufs/lfs/ulfs_vnops.c:1.49 src/sys/ufs/lfs/ulfs_vnops.c:1.50
--- src/sys/ufs/lfs/ulfs_vnops.c:1.49 Sat Jun 10 05:29:36 2017
+++ src/sys/ufs/lfs/ulfs_vnops.c Fri Aug 4 07:27:42 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ulfs_vnops.c,v 1.49 2017/06/10 05:29:36 maya Exp $ */
+/* $NetBSD: ulfs_vnops.c,v 1.50 2017/08/04 07:27:42 maya Exp $ */
/* from NetBSD: ufs_vnops.c,v 1.232 2016/05/19 18:32:03 riastradh Exp */
/*-
@@ -67,7 +67,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ulfs_vnops.c,v 1.49 2017/06/10 05:29:36 maya Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ulfs_vnops.c,v 1.50 2017/08/04 07:27:42 maya Exp $");
#if defined(_KERNEL_OPT)
#include "opt_lfs.h"
@@ -826,7 +826,7 @@ ulfs_readdir(void *v)
off = uio->uio_offset;
if (ap->a_cookies) {
- ccount = rcount / _DIRENT_RECLEN(ndp, 1);
+ ccount = rcount / LFS_DIRECTSIZ(fs, 1);
ccp = *(ap->a_cookies) = malloc(ccount * sizeof(*ccp),
M_TEMP, M_WAITOK);
} else {
