提交 a17d5232 编写于 作者: D Duane Griffin 提交者: Al Viro

eCryptfs: check readlink result was not an error before using it

The result from readlink is being used to index into the link name
buffer without checking whether it is a valid length. If readlink
returns an error this will fault or cause memory corruption.

Cc: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Cc: Dustin Kirkland <kirkland@canonical.com>
Cc: ecryptfs-devel@lists.launchpad.net
Signed-off-by: NDuane Griffin <duaneg@dghda.com>
Acked-by: NMichael Halcrow <mhalcrow@us.ibm.com>
Acked-by: NTyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
上级 5cc4a034
...@@ -673,10 +673,11 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd) ...@@ -673,10 +673,11 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ " ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
"dentry->d_name.name = [%s]\n", dentry->d_name.name); "dentry->d_name.name = [%s]\n", dentry->d_name.name);
rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
buf[rc] = '\0';
set_fs(old_fs); set_fs(old_fs);
if (rc < 0) if (rc < 0)
goto out_free; goto out_free;
else
buf[rc] = '\0';
rc = 0; rc = 0;
nd_set_link(nd, buf); nd_set_link(nd, buf);
goto out; goto out;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册