mirror of
https://github.com/linux-apfs/apfstests.git
synced 2026-05-01 15:01:44 -07:00
src/listxattr: Fix reading past the end of the user buffer
listxattr reaturns a null-terminated list of entries that represent the xattr names. However, if it is passed larger buffer than it requires it won't zero-out the rest of the memory. The way the loop iterator in listxattr.c is written makes it go print every null-terminated entry up to bufsize (which is user passed parameter). This can lead to a situation where listxattr users N bytes out of M bytes big buffer ( M > N). This will leave the rest (M-N) as garbage, which in turn will be printed by listxattr. Fix this by converting the 'for' loop to 'while' and properly ensuring we are reading at most howevermany elements the syscall reported it returned Signed-off-by: Nikolay Borisov <nborisov@suse.com> Reviewed-by: Eryu Guan <eguan@redhat.com> Signed-off-by: Eryu Guan <eguan@redhat.com>
This commit is contained in:
committed by
Eryu Guan
parent
ab6cd253da
commit
63a912525a
+3
-3
@@ -60,10 +60,10 @@ int main(int argc, char **argv)
|
||||
if (ret < 0) {
|
||||
perror("listxattr");
|
||||
} else {
|
||||
char *l;
|
||||
for (l = buf; l != (buf + bufsize) && *l != '\0';
|
||||
l = strchr(l, '\0') + 1) {
|
||||
char *l = buf;
|
||||
while (l < (buf + ret)) {
|
||||
printf("xattr: %s\n", l);
|
||||
l = strchr(l, '\0') + 1;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user