I've been doing some testing of fuse and discovered a small bug where it only 
allows file names up to 254 characters due to not taking the NULL terminator 
into consideration when allocating structures.

-- 
Helg <xx...@msn.com>



Index: dict.c
===================================================================
RCS file: /cvs/src/lib/libfuse/dict.c,v
retrieving revision 1.1
diff -u -p -u -p -r1.1 dict.c
--- dict.c      3 Jun 2013 16:00:50 -0000       1.1
+++ dict.c      27 Apr 2014 00:30:21 -0000
@@ -26,7 +26,7 @@
 #define        MAX_DICTKEY_SIZE        NAME_MAX
 struct dictentry {
        SPLAY_ENTRY(dictentry)  entry;
-       char                    key[MAX_DICTKEY_SIZE];
+       char                    key[MAX_DICTKEY_SIZE + 1];
        void                   *data;
 };
 
Index: fuse_private.h
===================================================================
RCS file: /cvs/src/lib/libfuse/fuse_private.h,v
retrieving revision 1.9
diff -u -p -u -p -r1.9 fuse_private.h
--- fuse_private.h      3 Dec 2013 09:59:40 -0000       1.9
+++ fuse_private.h      27 Apr 2014 00:30:22 -0000
@@ -34,7 +34,7 @@ struct fuse_vnode {
        ino_t ino;
        ino_t parent;
 
-       char path[NAME_MAX];
+       char path[NAME_MAX + 1];
        struct fuse_dirhandle *fd;
 
        SIMPLEQ_ENTRY(fuse_vnode) node; /* for dict */
Index: fuse_subr.c
===================================================================
RCS file: /cvs/src/lib/libfuse/fuse_subr.c,v
retrieving revision 1.7
diff -u -p -u -p -r1.7 fuse_subr.c
--- fuse_subr.c 5 Feb 2014 20:13:58 -0000       1.7
+++ fuse_subr.c 27 Apr 2014 00:30:22 -0000
@@ -35,8 +35,7 @@ alloc_vn(struct fuse *f, const char *pat
 
        vn->ino = ino;
        vn->parent = parent;
-       strncpy(vn->path, path, NAME_MAX);
-       vn->path[NAME_MAX - 1] =  '\0';
+       strlcpy(vn->path, path, sizeof(vn->path));
        if (ino == (ino_t)-1) {
                f->max_ino++;
                vn->ino = f->max_ino;



Reply via email to