diff options
| author | Andreas Gruenbacher <agruenba@redhat.com> | 2018-12-17 14:38:26 +0100 |
|---|---|---|
| committer | Andreas Gruenbacher <agruenba@redhat.com> | 2018-12-17 14:43:59 +0100 |
| commit | cb4786f1b6eb694545541bef89f942b00c2ff022 (patch) | |
| tree | 29edb340f364e7038d13cca11367eb6ec6004877 | |
| parent | 384983af853bd800c3ddf2a4f8004967888fda8d (diff) | |
| download | attr-cb4786f1b6eb694545541bef89f942b00c2ff022.tar.gz | |
attr_list, attr_listf: Guard against unterminated buffer
attr_list and attr_listf can crash when the listxattr, llistxattr, or
flistxattr syscalls incorrectly return an unterminated buffer. Guard
against that by always appending a null character.
| -rw-r--r-- | libattr/libattr.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/libattr/libattr.c b/libattr/libattr.c index 8180c3f..d550e10 100644 --- a/libattr/libattr.c +++ b/libattr/libattr.c @@ -290,7 +290,7 @@ attr_list(const char *path, char *buffer, const int buffersize, int flags, { const char *l; int length, vlength, count = 0; - char lbuf[MAXLISTLEN]; + char lbuf[MAXLISTLEN+1]; char name[MAXNAMELEN+16]; int start_offset, end_offset; @@ -301,11 +301,12 @@ attr_list(const char *path, char *buffer, const int buffersize, int flags, bzero(buffer, sizeof(attrlist_t)); if (flags & ATTR_DONTFOLLOW) - length = llistxattr(path, lbuf, sizeof(lbuf)); + length = llistxattr(path, lbuf, sizeof(lbuf) - 1); else - length = listxattr(path, lbuf, sizeof(lbuf)); + length = listxattr(path, lbuf, sizeof(lbuf) - 1); if (length <= 0) return length; + lbuf[length] = 0; /* not supposed to be necessary */ start_offset = sizeof(attrlist_t); end_offset = buffersize & ~(8-1); /* 8 byte align */ @@ -340,7 +341,7 @@ attr_listf(int fd, char *buffer, const int buffersize, int flags, { const char *l; int length, vlength, count = 0; - char lbuf[MAXLISTLEN]; + char lbuf[MAXLISTLEN+1]; char name[MAXNAMELEN+16]; int start_offset, end_offset; @@ -350,9 +351,10 @@ attr_listf(int fd, char *buffer, const int buffersize, int flags, } bzero(buffer, sizeof(attrlist_t)); - length = flistxattr(fd, lbuf, sizeof(lbuf)); + length = flistxattr(fd, lbuf, sizeof(lbuf) - 1); if (length < 0) return length; + lbuf[length] = 0; /* not supposed to be necessary */ start_offset = sizeof(attrlist_t); end_offset = buffersize & ~(8-1); /* 8 byte align */ |