d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mdmfs: Fix many bugs in automatic md(4) creation.

Browse Source 
This code allocated a correctly sized buffer, read past the end of the
source buffer, writing off the end of the target buffer, and then writing
a '\0' terminator past the end of the target buffer (in the wrong place).
It then leaked the buffer.

Switch to a statically sized buffer on the stack and update the source
pointer and
length before use so the correct things are copied.

Fix a logic error in the checks that the format of the line is as
expected and move on out of an assert.

Remove an unneeded close(). fclose() closes the descriptor.

Found with:	CheriABI
Obtained from:	CheriBSD
Reviewed by:	kib, jhb, markj
Differential Revision:	https://reviews.freebsd.org/D19122
This commit is contained in:
Brooks Davis 2019-02-11 21:31:26 +00:00
parent 967b2dce02
commit f95509a489
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sbin/mdmfs/mdmfs.c
View File

@ -444,7 +444,8 @@ static void
do_mdconfig_attach_au(const char *args, const enum md_types mdtype)
{
const char *ta; /* Type arg. */
char *linep, *linebuf; /* Line pointer, line buffer. */
char *linep;
char linebuf[12]; /* 32-bit unit (10) + '\n' (1) + '\0' (1) */
int fd; /* Standard output of mdconfig invocation. */
FILE *sfd;
int rv;
@ -479,14 +480,15 @@ do_mdconfig_attach_au(const char *args, const enum md_types mdtype)
if (sfd == NULL)
err(1, "fdopen");
linep = fgetln(sfd, &linelen);
if (linep == NULL && linelen < mdnamelen + 1)
errx(1, "unexpected output from mdconfig (attach)");
/* If the output format changes, we want to know about it. */
assert(strncmp(linep, mdname, mdnamelen) == 0);
linebuf = malloc(linelen - mdnamelen + 1);
assert(linebuf != NULL);
if (linep == NULL || linelen <= mdnamelen + 1 ||
linelen - mdnamelen >= sizeof(linebuf) ||
strncmp(linep, mdname, mdnamelen) != 0)
errx(1, "unexpected output from mdconfig (attach)");
linep += mdnamelen;
linelen -= mdnamelen;
/* Can't use strlcpy because linep is not NULL-terminated. */
strncpy(linebuf, linep + mdnamelen, linelen);
strncpy(linebuf, linep, linelen);
linebuf[linelen] = '\0';
ul = strtoul(linebuf, &p, 10);
if (ul == ULONG_MAX || *p != '\n')
@ -494,7 +496,6 @@ do_mdconfig_attach_au(const char *args, const enum md_types mdtype)
unit = ul;
fclose(sfd);
close(fd);
}
/*