You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
51 lines
1.3 KiB
51 lines
1.3 KiB
autofs-5.1.7 - add buffer length check to rmdir_path()
|
|
|
|
From: Ian Kent <raven@themaw.net>
|
|
|
|
Add a length check before copying the incoming path string to the work
|
|
buffer.
|
|
|
|
Signed-off-by: Ian Kent <raven@themaw.net>
|
|
---
|
|
CHANGELOG | 1 +
|
|
daemon/automount.c | 8 ++++++--
|
|
2 files changed, 7 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/CHANGELOG b/CHANGELOG
|
|
index ded0f00f..38304720 100644
|
|
--- a/CHANGELOG
|
|
+++ b/CHANGELOG
|
|
@@ -86,6 +86,7 @@
|
|
- add mapent path length check in handle_packet_expire_direct().
|
|
- add copy length check in umount_autofs_indirect().
|
|
- add some buffer length checks to master map parser.
|
|
+- add buffer length check to rmdir_path().
|
|
|
|
25/01/2021 autofs-5.1.7
|
|
- make bind mounts propagation slave by default.
|
|
diff --git a/daemon/automount.c b/daemon/automount.c
|
|
index 45e0833f..114b013a 100644
|
|
--- a/daemon/automount.c
|
|
+++ b/daemon/automount.c
|
|
@@ -241,15 +241,19 @@ int mkdir_path(const char *path, mode_t mode)
|
|
int rmdir_path(struct autofs_point *ap, const char *path, dev_t dev)
|
|
{
|
|
int len = strlen(path);
|
|
- char buf[PATH_MAX];
|
|
+ char buf[PATH_MAX + 1];
|
|
char *cp;
|
|
int first = 1;
|
|
struct stat st;
|
|
struct statfs fs;
|
|
|
|
+ if (len > PATH_MAX) {
|
|
+ error(ap->logopt, "path longer than maximum length");
|
|
+ return -1;
|
|
+ }
|
|
strcpy(buf, path);
|
|
- cp = buf + len;
|
|
|
|
+ cp = buf + len;
|
|
do {
|
|
*cp = '\0';
|
|
|
|
|