libc/sys-minix/mount.c: fix overflow
Fix a bug where a filesystem label could overflow the reserved buffer. This was already possible with 32 bits values, but is more proeminent with dev_t being 64 bits. Change-Id: Idc04ed355d1dd92b7a8ce4699de832661a5c4ccd
This commit is contained in:
parent
c9072ba0bb
commit
a00e322bea
2 changed files with 9 additions and 7 deletions
|
@ -9,6 +9,8 @@
|
||||||
#define MS_REUSE 0x001 /* Tell RS to try reusing binary from memory */
|
#define MS_REUSE 0x001 /* Tell RS to try reusing binary from memory */
|
||||||
#define MS_EXISTING 0x002 /* Tell mount to use already running server */
|
#define MS_EXISTING 0x002 /* Tell mount to use already running server */
|
||||||
|
|
||||||
|
#define MNT_LABEL_LEN 16 /* Length of fs label including nul */
|
||||||
|
|
||||||
/* Legacy definitions. */
|
/* Legacy definitions. */
|
||||||
#define MNTNAMELEN 16 /* Length of fs type name including nul */
|
#define MNTNAMELEN 16 /* Length of fs type name including nul */
|
||||||
#define MNTFLAGLEN 64 /* Length of flags string including nul */
|
#define MNTFLAGLEN 64 /* Length of flags string including nul */
|
||||||
|
|
|
@ -39,7 +39,7 @@ int mountflags, srvflags;
|
||||||
int r;
|
int r;
|
||||||
message m;
|
message m;
|
||||||
struct stat statbuf;
|
struct stat statbuf;
|
||||||
char label[16];
|
char label[MNT_LABEL_LEN];
|
||||||
char path[PATH_MAX];
|
char path[PATH_MAX];
|
||||||
char cmd[200];
|
char cmd[200];
|
||||||
char *p;
|
char *p;
|
||||||
|
@ -75,24 +75,24 @@ int mountflags, srvflags;
|
||||||
errno = EINVAL;
|
errno = EINVAL;
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
sprintf(label, "fs_%.12s", p);
|
snprintf(label, MNT_LABEL_LEN, "fs_%.12s", p);
|
||||||
} else {
|
} else {
|
||||||
/* check for a rslabel option in the arguments and try to use
|
/* check for a rslabel option in the arguments and try to use
|
||||||
* that.
|
* that.
|
||||||
*/
|
*/
|
||||||
rslabel = find_rslabel(args);
|
rslabel = find_rslabel(args);
|
||||||
if (rslabel != NULL){
|
if (rslabel != NULL){
|
||||||
snprintf(label,16,"%s",rslabel);
|
snprintf(label, MNT_LABEL_LEN, "%s", rslabel);
|
||||||
free(rslabel);
|
free(rslabel);
|
||||||
} else {
|
} else {
|
||||||
if (stat(name, &statbuf) < 0) return -1;
|
if (stat(name, &statbuf) < 0) return -1;
|
||||||
sprintf(label, "fs_%04x%llx", statbuf.st_dev, statbuf.st_ino);
|
snprintf(label, MNT_LABEL_LEN, "fs_%llx_%llx", statbuf.st_dev, statbuf.st_ino);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
/* label to long? */
|
/* label to long? */
|
||||||
if (strlen(type) < 16) {
|
if (strlen(type) < MNT_LABEL_LEN) {
|
||||||
sprintf(label, "%s", type);
|
snprintf(label, MNT_LABEL_LEN, "%s", type);
|
||||||
} else {
|
} else {
|
||||||
errno = ENOMEM;
|
errno = ENOMEM;
|
||||||
return -1;
|
return -1;
|
||||||
|
@ -174,7 +174,7 @@ int umount(name, srvflags)
|
||||||
const char *name;
|
const char *name;
|
||||||
int srvflags;
|
int srvflags;
|
||||||
{
|
{
|
||||||
char label[16];
|
char label[MNT_LABEL_LEN];
|
||||||
message m;
|
message m;
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue