From owner-freebsd-current@FreeBSD.ORG  Mon Dec  1 00:55:55 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 715B316A4CE
	for <current@freebsd.org>; Mon,  1 Dec 2003 00:55:55 -0800 (PST)
Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 53BDA43FDF
	for <current@freebsd.org>; Mon,  1 Dec 2003 00:55:52 -0800 (PST)
	(envelope-from dillon@apollo.backplane.com)
Received: from apollo.backplane.com (localhost [127.0.0.1])
	by apollo.backplane.com (8.12.9p2/8.12.9) with ESMTP id hB18tqiF019142
	for <current@freebsd.org>; Mon, 1 Dec 2003 00:55:52 -0800 (PST)
	(envelope-from dillon@apollo.backplane.com)
Received: (from dillon@localhost)
	by apollo.backplane.com (8.12.9p2/8.12.9/Submit) id hB18tqNZ019141;
	Mon, 1 Dec 2003 00:55:52 -0800 (PST)
	(envelope-from dillon)
Date: Mon, 1 Dec 2003 00:55:52 -0800 (PST)
From: Matthew Dillon <dillon@apollo.backplane.com>
Message-Id: <200312010855.hB18tqNZ019141@apollo.backplane.com>
To: current@freebsd.org
Subject: bug in CD9660 path handling in libstand (effects boot code)
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Dec 2003 08:55:55 -0000

    This fixes a bug where an attempt to load a file path which contains
    an intermediate path element which is a file on the CD rather then
    a directory results in the file being accessed like a directory... which
    can lockup the boot code.

    The fix is simple.  Check to see if an intermediate path element really
    represents a directory and return ENOENT if it doesn't.

    This situation can occur due to searches via the module search path.

					-Matt
					Matthew Dillon 
					<dillon@backplane.com>

Index: cd9660.c
===================================================================
RCS file: /cvs/src/lib/libstand/cd9660.c,v
retrieving revision 1.3
diff -u -r1.3 cd9660.c
--- cd9660.c	8 Aug 2003 04:18:34 -0000	1.3
+++ cd9660.c	1 Dec 2003 08:37:25 -0000
@@ -372,7 +372,13 @@
 		rec = *dp;
 		while (*path && *path != '/') /* look for next component */
 			path++;
-		if (*path) path++; /* skip '/' */
+		if (*path == '/') {	/* skip /, make sure is dir */
+			path++;
+			if (*path && (isonum_711(dp->flags) & 2) == 0) {
+				rc = ENOENT;	/* not directory */
+				goto out;
+			}
+		}
 	}
 
 	/* allocate file system specific data structure */