VFS: fetch_name() buffer underflow (reported by John Peace, bug #305)
This commit is contained in:
parent
4903a734b8
commit
42f0bf7dda
|
@ -34,7 +34,7 @@ int flag; /* M3 means path may be in message */
|
||||||
* If it is not, go copy it from user space.
|
* If it is not, go copy it from user space.
|
||||||
*/
|
*/
|
||||||
register char *rpu, *rpm;
|
register char *rpu, *rpm;
|
||||||
int r;
|
int r, count;
|
||||||
|
|
||||||
if (len > PATH_MAX) {
|
if (len > PATH_MAX) {
|
||||||
#if 0
|
#if 0
|
||||||
|
@ -61,7 +61,8 @@ int flag; /* M3 means path may be in message */
|
||||||
/* Just copy the path from the message to 'user_fullpath'. */
|
/* Just copy the path from the message to 'user_fullpath'. */
|
||||||
rpu = &user_fullpath[0];
|
rpu = &user_fullpath[0];
|
||||||
rpm = m_in.pathname; /* contained in input message */
|
rpm = m_in.pathname; /* contained in input message */
|
||||||
do { *rpu++ = *rpm++; } while (--len);
|
count = len;
|
||||||
|
do { *rpu++ = *rpm++; } while (--count);
|
||||||
r = OK;
|
r = OK;
|
||||||
} else {
|
} else {
|
||||||
/* String is not contained in the message. Get it from user space. */
|
/* String is not contained in the message. Get it from user space. */
|
||||||
|
|
Loading…
Reference in a new issue