Sat Aug 19 04:17:11 2017 UTC ()
Pull up following revision(s) (requested by mrg in ticket #1482):
	sys/kern/vfs_getcwd.c: revision 1.52
Don't walk off the end of the dirent buffer.
From Ilja Van Sprundel.


(snj)
diff -r1.47 -r1.47.14.1 src/sys/kern/vfs_getcwd.c
cvs diff -r1.47 -r1.47.14.1 src/sys/kern/vfs_getcwd.c (expand / switch to unified diff)

--- src/sys/kern/vfs_getcwd.c 2010/11/30 10:30:02 1.47
+++ src/sys/kern/vfs_getcwd.c 2017/08/19 04:17:11 1.47.14.1
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: vfs_getcwd.c,v 1.47 2010/11/30 10:30:02 dholland Exp $ */ 1/* $NetBSD: vfs_getcwd.c,v 1.47.14.1 2017/08/19 04:17:11 snj Exp $ */
2 2
3/*- 3/*-
4 * Copyright (c) 1999 The NetBSD Foundation, Inc. 4 * Copyright (c) 1999 The NetBSD Foundation, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * This code is derived from software contributed to The NetBSD Foundation 7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Bill Sommerfeld. 8 * by Bill Sommerfeld.
9 * 9 *
10 * Redistribution and use in source and binary forms, with or without 10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions 11 * modification, are permitted provided that the following conditions
12 * are met: 12 * are met:
13 * 1. Redistributions of source code must retain the above copyright 13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer. 14 * notice, this list of conditions and the following disclaimer.
@@ -20,27 +20,27 @@ @@ -20,27 +20,27 @@
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE. 29 * POSSIBILITY OF SUCH DAMAGE.
30 */ 30 */
31 31
32#include <sys/cdefs.h> 32#include <sys/cdefs.h>
33__KERNEL_RCSID(0, "$NetBSD: vfs_getcwd.c,v 1.47 2010/11/30 10:30:02 dholland Exp $"); 33__KERNEL_RCSID(0, "$NetBSD: vfs_getcwd.c,v 1.47.14.1 2017/08/19 04:17:11 snj Exp $");
34 34
35#include <sys/param.h> 35#include <sys/param.h>
36#include <sys/systm.h> 36#include <sys/systm.h>
37#include <sys/namei.h> 37#include <sys/namei.h>
38#include <sys/filedesc.h> 38#include <sys/filedesc.h>
39#include <sys/kernel.h> 39#include <sys/kernel.h>
40#include <sys/file.h> 40#include <sys/file.h>
41#include <sys/stat.h> 41#include <sys/stat.h>
42#include <sys/vnode.h> 42#include <sys/vnode.h>
43#include <sys/mount.h> 43#include <sys/mount.h>
44#include <sys/proc.h> 44#include <sys/proc.h>
45#include <sys/uio.h> 45#include <sys/uio.h>
46#include <sys/kmem.h> 46#include <sys/kmem.h>
@@ -197,27 +197,28 @@ unionread: @@ -197,27 +197,28 @@ unionread:
197 char *cpos; 197 char *cpos;
198 struct dirent *dp; 198 struct dirent *dp;
199 199
200 cpos = dirbuf; 200 cpos = dirbuf;
201 tries = 0; 201 tries = 0;
202 202
203 /* scan directory page looking for matching vnode */ 203 /* scan directory page looking for matching vnode */
204 for (len = (dirbuflen - uio.uio_resid); len > 0; 204 for (len = (dirbuflen - uio.uio_resid); len > 0;
205 len -= reclen) { 205 len -= reclen) {
206 dp = (struct dirent *) cpos; 206 dp = (struct dirent *) cpos;
207 reclen = dp->d_reclen; 207 reclen = dp->d_reclen;
208 208
209 /* check for malformed directory.. */ 209 /* check for malformed directory.. */
210 if (reclen < _DIRENT_MINSIZE(dp)) { 210 if (reclen < _DIRENT_MINSIZE(dp) ||
 211 reclen > len) {
211 error = EINVAL; 212 error = EINVAL;
212 goto out; 213 goto out;
213 } 214 }
214 /* 215 /*
215 * XXX should perhaps do VOP_LOOKUP to 216 * XXX should perhaps do VOP_LOOKUP to
216 * check that we got back to the right place, 217 * check that we got back to the right place,
217 * but getting the locking games for that 218 * but getting the locking games for that
218 * right would be heinous. 219 * right would be heinous.
219 */ 220 */
220 if ((dp->d_type != DT_WHT) && 221 if ((dp->d_type != DT_WHT) &&
221 (dp->d_fileno == fileno)) { 222 (dp->d_fileno == fileno)) {
222 char *bp = *bpp; 223 char *bp = *bpp;
223 224