d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid possible overflow when calclating malloc size for auxillary

Browse Source 
data structure sizes when mounting and reloading UFS/FFS
filesystems by using a u_long rather than an int for the size.

Reported by: Mariusz Zaborski <oshogbo@>
MFC after:   1 week
This commit is contained in:
Kirk McKusick 2016-10-28 20:15:19 +00:00
parent ab1b41edb5
commit ad544726aa
1 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sys/ufs/ffs/ffs_vfsops.c
View File

@ -588,7 +588,8 @@ ffs_reload(struct mount *mp, struct thread *td, int flags)
struct fs *fs, *newfs;
struct ufsmount *ump;
ufs2_daddr_t sblockloc;
int i, blks, size, error;
int i, blks, error;
u_long size;
int32_t *lp;
ump = VFSTOUFS(mp);
@ -658,7 +659,7 @@ ffs_reload(struct mount *mp, struct thread *td, int flags)
size += fs->fs_ncg * sizeof(int32_t);
size += fs->fs_ncg * sizeof(u_int8_t);
free(fs->fs_csp, M_UFSMNT);
space = malloc((u_long)size, M_UFSMNT, M_WAITOK);
space = malloc(size, M_UFSMNT, M_WAITOK);
fs->fs_csp = space;
for (i = 0; i < blks; i += fs->fs_frag) {
size = fs->fs_bsize;
@ -751,7 +752,8 @@ ffs_mountfs(devvp, mp, td)
struct cdev *dev;
void *space;
ufs2_daddr_t sblockloc;
int error, i, blks, size, ronly;
int error, i, blks, len, ronly;
u_long size;
int32_t *lp;
struct ucred *cred;
struct g_consumer *cp;
@ -856,11 +858,11 @@ ffs_mountfs(devvp, mp, td)
/*
* Get journal provider name.
*/
size = 1024;
mp->mnt_gjprovider = malloc(size, M_UFSMNT, M_WAITOK);
if (g_io_getattr("GJOURNAL::provider", cp, &size,
len = 1024;
mp->mnt_gjprovider = malloc((u_long)len, M_UFSMNT, M_WAITOK);
if (g_io_getattr("GJOURNAL::provider", cp, &len,
mp->mnt_gjprovider) == 0) {
mp->mnt_gjprovider = realloc(mp->mnt_gjprovider, size,
mp->mnt_gjprovider = realloc(mp->mnt_gjprovider, len,
M_UFSMNT, M_WAITOK);
MNT_ILOCK(mp);
mp->mnt_flag |= MNT_GJOURNAL;
@ -912,7 +914,7 @@ ffs_mountfs(devvp, mp, td)
if (fs->fs_contigsumsize > 0)
size += fs->fs_ncg * sizeof(int32_t);
size += fs->fs_ncg * sizeof(u_int8_t);
space = malloc((u_long)size, M_UFSMNT, M_WAITOK);
space = malloc(size, M_UFSMNT, M_WAITOK);
fs->fs_csp = space;
for (i = 0; i < blks; i += fs->fs_frag) {
size = fs->fs_bsize;
@ -997,8 +999,8 @@ ffs_mountfs(devvp, mp, td)
#endif
}
if ((fs->fs_flags & FS_TRIM) != 0) {
size = sizeof(int);
if (g_io_getattr("GEOM::candelete", cp, &size,
len = sizeof(int);
if (g_io_getattr("GEOM::candelete", cp, &len,
&ump->um_candelete) == 0) {
if (!ump->um_candelete)
printf("WARNING: %s: TRIM flag on fs but disk "