netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Handle arbitrarily large Fuse Dirent Namelen.

Browse Source 
If FUSEDirent.Namelen is larger than the remaining payload size, then the
dirent is probably invalid. We should skip it.

PiperOrigin-RevId: 566678679
This commit is contained in:
Ayush Ranjan
2023-09-19 10:48:35 -07:00
committed by gVisor bot
parent 8a7617aed2
commit 8675708cb8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/abi/linux/fuse.go
+1 -1
View File
@@ -985,7 +985,7 @@ func (r *FUSEDirent) shiftNextDirent(buf []byte) []byte {
func (r *FUSEDirent) UnmarshalBytes(src []byte) []byte {
srcP := r.Meta.UnmarshalBytes(src)
if r.Meta.NameLen > FUSE_NAME_MAX {
if r.Meta.NameLen > FUSE_NAME_MAX || r.Meta.NameLen > uint32(len(srcP)) {
// The name is too long and therefore invalid. We don't
// need to unmarshal the name since it'll be thrown away.
return r.shiftNextDirent(src)