Changeset 3914 for trunk/libc/src/kNIX/b_fsPathResolve.c

Timestamp:

Oct 24, 2014, 4:01:38 PM (11 years ago)

Author:

bird

Message:

trunk,0.6: Fixed buffer overflow in fsResolveUnix that would trigger if the input path was too long.

File:

• trunk/libc/src/kNIX/b_fsPathResolve.c (modified) (1 diff)

trunk/libc/src/kNIX/b_fsPathResolve.c

@@ -53 +53 @@
      */
     int             fInUnixTree = 0;
-    char            szNativePath[PATH_MAX];
     unsigned int    fBackFsFlags = fFlags & __LIBC_BACKFS_FLAGS_RESOLVE_FULL_MAYBE
                                  ? BACKFS_FLAGS_RESOLVE_DIR_MAYBE | BACKFS_FLAGS_RESOLVE_FULL_MAYBE
                                  : BACKFS_FLAGS_RESOLVE_DIR_MAYBE | BACKFS_FLAGS_RESOLVE_FULL;
-    szNativePath[0] = szNativePath[1] = szNativePath[2] = szNativePath[3] = '\0';
-    rc = __libc_back_fsResolve(pszPath, fBackFsFlags, szNativePath, &fInUnixTree);
+    if (!(fFlags & __LIBC_BACKFS_FLAGS_RESOLVE_DIRECT_BUF))
+    {
+        char            szNativePath[PATH_MAX];
+        szNativePath[0] = szNativePath[1] = szNativePath[2] = szNativePath[3] = '\0';
+        rc = __libc_back_fsResolve(pszPath, fBackFsFlags, szNativePath, &fInUnixTree);
 
-    /*
-     * Copy the (half) result back to the caller.
-     */
-    char *pszSrc = &szNativePath[0];
-    if (   !(fFlags & __LIBC_BACKFS_FLAGS_RESOLVE_NATIVE)
-        && fInUnixTree
-        && *pszSrc)
+        /*
+         * Copy the (half) result back to the caller.
+         */
+        char *pszSrc = &szNativePath[0];
+        if (   !(fFlags & __LIBC_BACKFS_FLAGS_RESOLVE_NATIVE)
+            && fInUnixTree
+            && *pszSrc)
+        {
+            pszSrc += __libc_gcchUnixRoot;
+            LIBC_ASSERTM(*pszSrc == '/', "bogus fInUnixTree flag! pszSrc='%s' whole thing is '%s'\n", pszSrc, szNativePath);
+        }
+        __libc_back_fsMutexRelease();
+
+        int cch = strlen(pszSrc) + 1;
+        if (cch < cchBuf)
+            memcpy(pszBuf, pszSrc, cchBuf);
+        else if (!rc)
+            rc = -ERANGE;
+    }
+    else
     {
-        pszSrc += __libc_gcchUnixRoot;
-        LIBC_ASSERTM(*pszSrc == '/', "bogus fInUnixTree flag! pszSrc='%s' whole thing is '%s'\n", pszSrc, szNativePath);
-    }
-    __libc_back_fsMutexRelease();
+        /*
+         * Special case for testing purposes only.
+         */
+        if (cchBuf >= PATH_MAX)
+        {
+            rc = __libc_back_fsResolve(pszPath, fBackFsFlags, pszBuf, &fInUnixTree);
+            if (   !(fFlags & __LIBC_BACKFS_FLAGS_RESOLVE_NATIVE)
+                && fInUnixTree
+                && pszBuf)
+            {
+                memmove(pszBuf, pszBuf + __libc_gcchUnixRoot, strlen(pszBuf) - __libc_gcchUnixRoot + 1);
+                LIBC_ASSERTM(*pszBuf== '/', "bogus fInUnixTree flag! pszBuf='%s'\n", pszBuf);
+            }
+        }
+        else
+            rc = EINVAL;
 
-    int cch = strlen(pszSrc) + 1;
-    if (cch < cchBuf)
-        memcpy(pszBuf, pszSrc, cchBuf);
-    else if (!rc)
-        rc = -ERANGE;
+        __libc_back_fsMutexRelease();
+     }
 
     if (!rc)