mirror of
https://git.freebsd.org/ports.git
synced 2025-04-28 17:46:38 -04:00
3fb51f85c5
Update a call to memcpy() because readdir() only guarantees memory up to result+result->d_reclen is readable. Under certain conditions, result+sizeof(struct dirent) landed in unmapped memory. Most of the legwork to pinpoint the problem, as well as a solution similar to the one applied here, was submitted by uratan@miomio.jp. Martin Simmons <martin@lispworks.com> contributed to understanding the problem and wrote a useful test case. PR: 275597 Approved by: maintainer timeout Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D43171
14 lines
607 B
C
14 lines
607 B
C
--- source3/modules/vfs_cap.c.orig 2022-01-24 10:26:59 UTC
|
|
+++ source3/modules/vfs_cap.c
|
|
@@ -112,7 +112,10 @@ static struct dirent *cap_readdir(vfs_handle_struct *h
|
|
return NULL;
|
|
}
|
|
talloc_set_name_const(newdirent, "struct dirent");
|
|
- memcpy(newdirent, result, sizeof(struct dirent));
|
|
+ /* See FreeBSD bug #275597 for an explanation of this patch. */
|
|
+ /* memcpy(newdirent, result, sizeof(struct dirent)); */
|
|
+ memcpy(newdirent, result, result->d_reclen);
|
|
+ /*******************************************************************/
|
|
memcpy(&newdirent->d_name, newname, newnamelen);
|
|
return newdirent;
|
|
}
|