| Message ID | 20120816212019.GB3688@altlinux.org |
|---|---|
| State | New |
| Headers | show |
CC'ed to linux-user maintainer, Riku. On Fri, Aug 17, 2012 at 01:20:19AM +0400, Dmitry V. Levin wrote: > In case when TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64, the last > byte of the target dirent structure (aka d_type byte) was never copied > from the native dirent structure, thus breaking everything that relies > on valid d_type value, e.g. glob(3). > > Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> > --- > linux-user/syscall.c | 7 +++---- > linux-user/syscall_defs.h | 3 ++- > 2 files changed, 5 insertions(+), 5 deletions(-) > > diff --git a/linux-user/syscall.c b/linux-user/syscall.c > index 41c869b..2b6025b 100644 > --- a/linux-user/syscall.c > +++ b/linux-user/syscall.c > @@ -7030,10 +7030,9 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, > tde->d_ino = tswapal(de->d_ino); > tde->d_off = tswapal(de->d_off); > tnamelen = treclen - (2 * sizeof(abi_long) + 2); > - if (tnamelen > 256) > - tnamelen = 256; > - /* XXX: may not be correct */ > - pstrcpy(tde->d_name, tnamelen, de->d_name); > + if (tnamelen > sizeof(tde->d_name)) > + tnamelen = sizeof(tde->d_name); > + memcpy(tde->d_name, de->d_name, tnamelen); > de = (struct linux_dirent *)((char *)de + reclen); > len -= reclen; > tde = (struct target_dirent *)((char *)tde + treclen); > diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h > index 2cfda5a..f27a8d4 100644 > --- a/linux-user/syscall_defs.h > +++ b/linux-user/syscall_defs.h > @@ -258,7 +258,8 @@ struct target_dirent { > abi_long d_ino; > abi_long d_off; > unsigned short d_reclen; > - char d_name[256]; /* We must not include limits.h! */ > + char d_name[257]; /* We must not include limits.h! */ > + /* 257 = NAME_MAX + '\0' + d_type */ > }; > > struct target_dirent64 { > > -- > ldv
On Thu, Aug 16, 2012 at 9:20 PM, Dmitry V. Levin <ldv@altlinux.org> wrote: > In case when TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64, the last > byte of the target dirent structure (aka d_type byte) was never copied > from the native dirent structure, thus breaking everything that relies > on valid d_type value, e.g. glob(3). > > Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> > --- > linux-user/syscall.c | 7 +++---- > linux-user/syscall_defs.h | 3 ++- > 2 files changed, 5 insertions(+), 5 deletions(-) > > diff --git a/linux-user/syscall.c b/linux-user/syscall.c > index 41c869b..2b6025b 100644 > --- a/linux-user/syscall.c > +++ b/linux-user/syscall.c > @@ -7030,10 +7030,9 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, > tde->d_ino = tswapal(de->d_ino); > tde->d_off = tswapal(de->d_off); > tnamelen = treclen - (2 * sizeof(abi_long) + 2); > - if (tnamelen > 256) > - tnamelen = 256; > - /* XXX: may not be correct */ > - pstrcpy(tde->d_name, tnamelen, de->d_name); > + if (tnamelen > sizeof(tde->d_name)) > + tnamelen = sizeof(tde->d_name); Missing braces, please read CODING_STYLE. Otherwise patch looks good. > + memcpy(tde->d_name, de->d_name, tnamelen); > de = (struct linux_dirent *)((char *)de + reclen); > len -= reclen; > tde = (struct target_dirent *)((char *)tde + treclen); > diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h > index 2cfda5a..f27a8d4 100644 > --- a/linux-user/syscall_defs.h > +++ b/linux-user/syscall_defs.h > @@ -258,7 +258,8 @@ struct target_dirent { > abi_long d_ino; > abi_long d_off; > unsigned short d_reclen; > - char d_name[256]; /* We must not include limits.h! */ > + char d_name[257]; /* We must not include limits.h! */ > + /* 257 = NAME_MAX + '\0' + d_type */ > }; > > struct target_dirent64 { > > -- > ldv >
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 41c869b..2b6025b 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -7030,10 +7030,9 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, tde->d_ino = tswapal(de->d_ino); tde->d_off = tswapal(de->d_off); tnamelen = treclen - (2 * sizeof(abi_long) + 2); - if (tnamelen > 256) - tnamelen = 256; - /* XXX: may not be correct */ - pstrcpy(tde->d_name, tnamelen, de->d_name); + if (tnamelen > sizeof(tde->d_name)) + tnamelen = sizeof(tde->d_name); + memcpy(tde->d_name, de->d_name, tnamelen); de = (struct linux_dirent *)((char *)de + reclen); len -= reclen; tde = (struct target_dirent *)((char *)tde + treclen); diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h index 2cfda5a..f27a8d4 100644 --- a/linux-user/syscall_defs.h +++ b/linux-user/syscall_defs.h @@ -258,7 +258,8 @@ struct target_dirent { abi_long d_ino; abi_long d_off; unsigned short d_reclen; - char d_name[256]; /* We must not include limits.h! */ + char d_name[257]; /* We must not include limits.h! */ + /* 257 = NAME_MAX + '\0' + d_type */ }; struct target_dirent64 {
In case when TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64, the last byte of the target dirent structure (aka d_type byte) was never copied from the native dirent structure, thus breaking everything that relies on valid d_type value, e.g. glob(3). Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> --- linux-user/syscall.c | 7 +++---- linux-user/syscall_defs.h | 3 ++- 2 files changed, 5 insertions(+), 5 deletions(-)