Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix buffer overrun for symbolic links. PR/31325.

This commit is contained in:
yamt 2005-09-17 10:28:26 +00:00
parent 7e71f567e4
commit bea9347034
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/fs/tmpfs/tmpfs_subr.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: tmpfs_subr.c,v 1.6 2005/09/16 00:18:48 yamt Exp $ */ /* $NetBSD: tmpfs_subr.c,v 1.7 2005/09/17 10:28:26 yamt Exp $ */
/* /*
* Copyright (c) 2005 The NetBSD Foundation, Inc. * Copyright (c) 2005 The NetBSD Foundation, Inc.
@ -41,7 +41,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.6 2005/09/16 00:18:48 yamt Exp $"); __KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.7 2005/09/17 10:28:26 yamt Exp $");
#include <sys/param.h> #include <sys/param.h>
#include <sys/dirent.h> #include <sys/dirent.h>
@ -138,15 +138,15 @@ tmpfs_alloc_node(struct tmpfs_mount *tmp, enum vtype type,
case VLNK: case VLNK:
KASSERT(strlen(target) < MAXPATHLEN); KASSERT(strlen(target) < MAXPATHLEN);
nnode->tn_size = strlen(target);
nnode->tn_link = tmpfs_str_pool_get(&tmp->tm_str_pool, nnode->tn_link = tmpfs_str_pool_get(&tmp->tm_str_pool,
strlen(target), 0); nnode->tn_size, 0);
if (nnode->tn_link == NULL) { if (nnode->tn_link == NULL) {
nnode->tn_type = VNON; nnode->tn_type = VNON;
tmpfs_free_node(tmp, nnode); tmpfs_free_node(tmp, nnode);
return ENOSPC; return ENOSPC;
} }
strcpy(nnode->tn_link, target); memcpy(nnode->tn_link, target, nnode->tn_size);
nnode->tn_size = strlen(target);
break; break;
case VREG: case VREG:
@ -191,7 +191,7 @@ tmpfs_free_node(struct tmpfs_mount *tmp, struct tmpfs_node *node)
case VLNK: case VLNK:
tmpfs_str_pool_put(&tmp->tm_str_pool, node->tn_link, tmpfs_str_pool_put(&tmp->tm_str_pool, node->tn_link,
strlen(node->tn_link)); node->tn_size);
pages = 0; pages = 0;
break; break;