Date: Fri, 8 Nov 2002 10:47:21 -0800 (PST) From: Brian Feldman <green@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 20859 for review Message-ID: <200211081847.gA8IlL3D064594@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=20859 Change 20859 by green@green_laptop_2 on 2002/11/08 10:46:32 * Update the errors from the previous submission to be EIO now. * Add a few more consistency checks. Affected files ... .. //depot/projects/trustedbsd/mac/sys/ufs/ffs/ffs_vnops.c#17 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/ufs/ffs/ffs_vnops.c#17 (text+ko) ==== @@ -1328,8 +1328,8 @@ int *ealenp, u_char **eap, u_char **eac) { u_char *p, *pe, *pn, *p0; - int eapad1, eapad2, ealength, ealen, nlen; - uint32_t ul; + int eapad1, ealength, ealen, nlen; + uint32_t ul, eapad2; pe = ptr + length; nlen = strlen(name); @@ -1340,19 +1340,23 @@ pn = p + ul; /* make sure this entry is complete */ if (pn > pe) - break; + return (EIO); /* don't loop forever on a corrupt entry */ if (pn <= p) - return (EFTYPE); + return (EIO); p += sizeof(uint32_t); if (*p != nspace) continue; p++; eapad2 = *p++; + /* padding is at most 7 bytes */ + if (eapad2 >= 8) + return (EIO); if (*p != nlen) continue; p++; - if (bcmp(p, name, nlen)) + /* compare only up to the end of this attribute */ + if (p + nlen > pn || bcmp(p, name, nlen)) continue; ealength = sizeof(uint32_t) + 3 + nlen; eapad1 = 8 - (ealength % 8); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200211081847.gA8IlL3D064594>