Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix null deref; include \0 when copying paths

Browse Source 
git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@17662 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
François Revol 2006-05-31 00:01:01 +00:00
parent 373d946f22
commit 84aae13f6d
1 changed files with 7 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/system/kernel/fs/devfs.cpp
View File

@ -1580,13 +1580,13 @@ devfs_ioctl(fs_volume _fs, fs_vnode _vnode, fs_cookie _cookie, ulong op,
case B_GET_DRIVER_FOR_DEVICE:
{
const char *dpath;
if (!S_ISCHR(vnode->stream.type))
return B_NOT_ALLOWED;
if (!vnode->stream.u.dev.driver)
return B_ENTRY_NOT_FOUND;
dpath = vnode->stream.u.dev.driver->path;
if (!dpath)
return B_ENTRY_NOT_FOUND;
// should make sure it's \0 terminated on truncation
return user_memcpy(buffer, dpath, strnlen(dpath, 256));
return user_memcpy(buffer, dpath, strnlen(dpath, 255)+1);
}
case B_GET_PARTITION_INFO:
@ -1605,20 +1605,15 @@ devfs_ioctl(fs_volume _fs, fs_vnode _vnode, fs_cookie _cookie, ulong op,
case B_GET_PATH_FOR_DEVICE:
{
const char *dmp = "/dev/";
KPath path(dmp);
char *pbuf;
char path[256];
status_t err;
/* XXX: we might want to actually find the mountpoint
* of that instance of devfs...
* but for now we assume it's mounted on /dev
*/
if (path.InitCheck() != B_OK)
return B_NO_MEMORY;
pbuf = path.LockBuffer();
get_device_name(vnode, pbuf+strlen(dmp), path.BufferSize()-strlen(dmp));
err = user_memcpy(buffer, pbuf, strnlen(pbuf, 256));
path.UnlockBuffer();
strcpy(path, "/dev/");
get_device_name(vnode, path+5, sizeof(path)-5);
err = user_memcpy(buffer, path, strnlen(path, sizeof(path)-1)+1);
return err;
}