From owner-freebsd-bugs  Wed Apr 12 06:46:29 1995
Return-Path: bugs-owner
Received: (from majordom@localhost)
          by freefall.cdrom.com (8.6.10/8.6.6) id GAA13471
          for bugs-outgoing; Wed, 12 Apr 1995 06:46:29 -0700
Received: from munich.gcomm.com (munich.gcomm.com [199.227.15.15])
          by freefall.cdrom.com (8.6.10/8.6.6) with ESMTP id GAA13464
          for <bugs@freebsd.org>; Wed, 12 Apr 1995 06:46:28 -0700
Received: (from craig@localhost) by munich.gcomm.com (8.6.8.1/8.6.6) id JAA27823 for bugs@freebsd.org; Wed, 12 Apr 1995 09:48:27 -0400
From: Craig Yap <craig@munich.gcomm.com>
Message-Id: <199504121348.JAA27823@munich.gcomm.com>
Subject: seekdir bug
To: bugs@FreeBSD.org
Date: Wed, 12 Apr 1995 09:48:27 -0400 (EDT)
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Content-Length: 1599      
Sender: bugs-owner@FreeBSD.org
Precedence: bulk

There is a bug when seeking through a directory.  telldir() seems to return
a position in the directory that doesnt match the name of the file.  I've
included a program that will exploit the bug.  I ran it as followed:

First made some test files:
touch 1 2 3 4
then ran the program:
./a "?"

I will continually show the name=a eventhough the position is incremented

Thanks for your time,
Craig

/*
 * test the viability of seekdir() after closedir()
 *
 * requires: fnmatch() and dirent routines
 */

#include <dirent.h>
#include <fnmatch.h>

static long position=-1;

char *
findfile(char *spec)
{
     struct dirent *dent;
     DIR *dirp;

     if ((dirp=opendir(".")) == NULL) {
	  perror("opendir");
	  exit(2);
     }
     if (position != -1) {
	  seekdir(dirp,position);
     }
     while((dent=readdir(dirp)) != NULL) {
	  if (fnmatch(spec,dent->d_name,0) == 0 &&
	      strcmp(dent->d_name,".") != 0 &&
	      strcmp(dent->d_name,"..") != 0) {
	       position=telldir(dirp);
	       closedir(dirp);
	       return(dent->d_name);
	  }
     }
     closedir(dirp);
     return(NULL);
}


main(
int argc,
char *argv[])
{
     char *fname;

     if (argc != 2) {
	  printf("usage: testdirent \"<filespec>\"\n");
	  return(1);
     }
     while ((fname=findfile(argv[1])) != NULL) {
	  printf("name=%s position=%ld\n",fname,position);
     }
     return(0);
}
     
     

-- 
------------------------------------------------------------------------------
Craig Yap                                               craig@munich.gcomm.com
Software Engineer
Unix Technical Division
Galacticomm, Inc