From: NeilBrown Date: Tue, 1 May 2012 19:26:54 +0000 (-0400) Subject: v4_root_add_parents: remove a possible buffer overflow. X-Git-Tag: nfs-utils-1-2-6-rc7~6 X-Git-Url: https://git.decadent.org.uk/gitweb/?a=commitdiff_plain;h=4bcb8664cf44176a99fc2c4b92e7f28ee705a7d9;p=nfs-utils.git v4_root_add_parents: remove a possible buffer overflow. The loop in v4root_add_parents() is a little odd. The first time through, 'ptr' points immediately "beyond" a '/' character (the first). For every other iterration it points directly "at" a '/' character. Such inconsistency is error prone and infact there is an error. If "path" is precisely "/", then the first call to ptr = strchr(ptr, '/') will be given a 'ptr' which is beyond the '\0' at the end of "path". This could potentially contain anything and the strchr() could search well beyond a buffer (though this depends on exactly how the string is set up which depends on separate code). So change the loop to have 'ptr' always point at a '/', and handle the special case of "/" explicitly. Signed-off-by: NeilBrown Signed-off-by: Steve Dickson --- diff --git a/utils/mountd/v4root.c b/utils/mountd/v4root.c index 57ee0b2..708eb61 100644 --- a/utils/mountd/v4root.c +++ b/utils/mountd/v4root.c @@ -150,13 +150,13 @@ static int v4root_add_parents(nfs_export *exp) "pseudo export for '%s'", exp->m_export.e_path); return -ENOMEM; } - for (ptr = path + 1; ptr; ptr = strchr(ptr, '/')) { + for (ptr = path; ptr; ptr = strchr(ptr, '/')) { int ret; char saved; saved = *ptr; *ptr = '\0'; - ret = pseudofs_update(hostname, path, exp); + ret = pseudofs_update(hostname, *path ? path : "/", exp); if (ret) return ret; *ptr = saved;