Fix another bug in SUSP "CE" handling: when the SUSP records fit into

the System Use field with fewer then 28 bytes to spare, we were
remembering the wrong length for the System Use field and hence
emitting a corrupt directory entry.  This could be triggered by trying
to build a filesystem containing a regular file with a 120-byte name.
Now we're a little more careful.
This commit is contained in:
bjh21 2009-01-09 00:24:07 +00:00
parent 61773f97b8
commit 7dd482c240

View File

@ -1,4 +1,4 @@
/* $NetBSD: iso9660_rrip.c,v 1.5 2009/01/08 23:31:33 bjh21 Exp $ */
/* $NetBSD: iso9660_rrip.c,v 1.6 2009/01/09 00:24:07 bjh21 Exp $ */
/*
* Copyright (c) 2005 Daniel Watt, Walter Deignan, Ryan Gabrys, Alan
@ -43,7 +43,7 @@
#include <sys/cdefs.h>
#if defined(__RCSID) && !defined(__lint)
__RCSID("$NetBSD: iso9660_rrip.c,v 1.5 2009/01/08 23:31:33 bjh21 Exp $");
__RCSID("$NetBSD: iso9660_rrip.c,v 1.6 2009/01/09 00:24:07 bjh21 Exp $");
#endif /* !__lint */
static void cd9660_rrip_initialize_inode(cd9660node *);
@ -200,7 +200,7 @@ cd9660_rrip_finalize_node(cd9660node *node)
static int
cd9660_susp_handle_continuation_common(cd9660node *node, int space)
{
int ca_used, susp_used, working;
int ca_used, susp_used, susp_used_last, working;
struct ISO_SUSP_ATTRIBUTES *temp, *last = NULL, *CE;
working = 254 - space;
@ -216,9 +216,15 @@ cd9660_susp_handle_continuation_common(cd9660node *node, int space)
* CD9660_SUSP_ENTRY_SIZE(temp));
*/
working -= CD9660_SUSP_ENTRY_SIZE(temp);
if (working >= 28) {
last = temp;
if (working >= 0)
susp_used += CD9660_SUSP_ENTRY_SIZE(temp);
if (working >= 28) {
/*
* Remember the last entry after which we
* could insert a "CE" entry.
*/
last = temp;
susp_used_last = susp_used;
}
}
@ -229,7 +235,7 @@ cd9660_susp_handle_continuation_common(cd9660node *node, int space)
cd9660_susp_ce(CE, node);
/* This will automatically insert at the appropriate location */
TAILQ_INSERT_AFTER(&node->head, last, CE, rr_ll);
susp_used += 28;
susp_used = susp_used_last + 28;
/* Count how much CA data is necessary */
for (temp = TAILQ_NEXT(CE, rr_ll); temp != NULL;