autofs-5.1.7 - add buffer length check to rmdir_path()
From: Ian Kent <raven@themaw.net>
Add a length check before copying the incoming path string to the work
buffer.
Signed-off-by: Ian Kent <raven@themaw.net>
---
CHANGELOG | 1 +
daemon/automount.c | 8 ++++++--
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index ded0f00f..38304720 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -86,6 +86,7 @@
- add mapent path length check in handle_packet_expire_direct().
- add copy length check in umount_autofs_indirect().
- add some buffer length checks to master map parser.
+- add buffer length check to rmdir_path().
25/01/2021 autofs-5.1.7
- make bind mounts propagation slave by default.
diff --git a/daemon/automount.c b/daemon/automount.c
index 45e0833f..114b013a 100644
--- a/daemon/automount.c
+++ b/daemon/automount.c
@@ -241,15 +241,19 @@ int mkdir_path(const char *path, mode_t mode)
int rmdir_path(struct autofs_point *ap, const char *path, dev_t dev)
{
int len = strlen(path);
- char buf[PATH_MAX];
+ char buf[PATH_MAX + 1];
char *cp;
int first = 1;
struct stat st;
struct statfs fs;
+ if (len > PATH_MAX) {
+ error(ap->logopt, "path longer than maximum length");
+ return -1;
+ }
strcpy(buf, path);
- cp = buf + len;
+ cp = buf + len;
do {
*cp = '\0';