[PATCHv2 1/2] cld: fix CLD_INODE_NAME_MAX woes
Colin McCabe <[email protected]>
| Newsgroups | org.kernel.vger.hail-devel |
|---|---|
| Message-ID | <[email protected]> |
v2: one part of this patch was originally accidentally mixed into patch 2 When we create a static buffer for an inode name, and treat it like a null-terminated string, it needs to be of length CLD_INODE_NAME_MAX + 1 so that it can hold the NULL-terminator. In cldc_del and cldc_open, we should check that the user-submitted inode name is less than or equal to CLD_INODE_NAME_MAX. Formerly we were just checking that it wasn't too big to fit in the packet. When copying the inode name out of struct cld_dirent_cur, use snprintf rather than strcpy to ensure that we never overflow the buffer. This isn't strictly necessary if all other checks are working perfectly, but it seems prudent. Signed-off-by: Colin McCabe <[email protected]> --- include/cldc.h | 2 +- lib/cldc.c | 4 ++-- tools/cldcli.c | 1 + 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/include/cldc.h b/include/cldc.h index f1db7d2..0d72669 100644 --- a/include/cldc.h +++ b/include/cldc.h @@ -41,7 +41,7 @@ struct cldc_call_opts { struct cld_msg_get_resp resp; const char *buf; unsigned int size; - char inode_name[CLD_INODE_NAME_MAX]; + char inode_name[CLD_INODE_NAME_MAX + 1]; } get; } u; }; diff --git a/lib/cldc.c b/lib/cldc.c index 3dc565c..dcc179c 100644 --- a/lib/cldc.c +++ b/lib/cldc.c @@ -903,7 +903,7 @@ int cldc_del(struct cldc_session *sess, const struct cldc_call_opts *copts, return -EINVAL; plen = strlen(pathname); - if (plen > 65530) + if (plen > CLD_INODE_NAME_MAX) return -EINVAL; /* create DEL message */ @@ -974,7 +974,7 @@ int cldc_open(struct cldc_session *sess, return -EINVAL; plen = strlen(pathname); - if (plen > 65530) + if (plen > CLD_INODE_NAME_MAX) return -EINVAL; /* create OPEN message */ diff --git a/tools/cldcli.c b/tools/cldcli.c index c274e61..acf45d7 100644 --- a/tools/cldcli.c +++ b/tools/cldcli.c @@ -254,6 +254,7 @@ static int cb_ls_2(struct cldc_call_opts *copts_in, enum cle_err_codes errc) s = cldc_dirent_name(&dc); strcpy(lsr.name, s); + snprintf(lsr.name, CLD_INODE_NAME_MAX + 1, s); free(s); write_from_thread(&lsr, sizeof(lsr)); -- 1.6.2.5