mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 12:54:27 +00:00
Fix the check in dircheck() on namlen.
The value of namlen is copied from on-disk d_namlen, which is a 8-bit unsigned integer which can never exceed MAXNAMLEN (255) so the test is always true. Moreover, UFS does not allow d_namelen being zero. Change namlen from u_int to u_int8_t, and replace the unneeded test with a useful test. PR: bin/160339 Submitted by: Eugene Grosbein <eugen grosbein.pp.ru> MFC after: 2 weeks Approved by: re (kib)
This commit is contained in:
parent
7493181297
commit
fdc61a888d
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=225338
|
@ -210,7 +210,7 @@ dircheck(struct inodesc *idesc, struct direct *dp)
|
|||
size_t size;
|
||||
char *cp;
|
||||
u_char type;
|
||||
u_int namlen;
|
||||
u_int8_t namlen;
|
||||
int spaceleft;
|
||||
|
||||
spaceleft = DIRBLKSIZ - (idesc->id_loc % DIRBLKSIZ);
|
||||
|
@ -225,7 +225,7 @@ dircheck(struct inodesc *idesc, struct direct *dp)
|
|||
type = dp->d_type;
|
||||
if (dp->d_reclen < size ||
|
||||
idesc->id_filesize < size ||
|
||||
namlen > MAXNAMLEN ||
|
||||
namlen == 0 ||
|
||||
type > 15)
|
||||
goto bad;
|
||||
for (cp = dp->d_name, size = 0; size < namlen; size++)
|
||||
|
|
Loading…
Reference in a new issue