• D
    ext4: prevent stack overrun in ext4_file_open · cf803903
    Darrick J. Wong 提交于
    In ext4_file_open, the filesystem records the mountpoint of the first
    file that is opened after mounting the filesystem.  It does this by
    allocating a 64-byte stack buffer, calling d_path() to grab the mount
    point through which this file was accessed, and then memcpy()ing 64
    bytes into the superblock's s_last_mounted field, starting from the
    return value of d_path(), which is stored as "cp".  However, if cp >
    buf (which it frequently is since path components are prepended
    starting at the end of buf) then we can end up copying stack data into
    the superblock.
    
    Writing stack variables into the superblock doesn't sound like a great
    idea, so use strlcpy instead.  Andi Kleen suggested using strlcpy
    instead of strncpy.
    Signed-off-by: NDarrick J. Wong <djwong@us.ibm.com>
    Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
    cf803903
file.c 8.2 KB