From 2fd4fdcf3b0512c880033f4027941440fce93629 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Axel=20D=C3=B6rfler?= Date: Fri, 22 Aug 2008 08:02:38 +0000 Subject: [PATCH] * Changed the way fix_dirent() copies the entry: it will now copy the complete dirent without the name first, and will then check if the d_reclen member is valid before copying the name. * This shows the problem with the FAT file system that was revealed by r26859. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@27128 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/system/kernel/fs/vfs.cpp | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/system/kernel/fs/vfs.cpp b/src/system/kernel/fs/vfs.cpp index 51cef34fb4..9d9cf79057 100644 --- a/src/system/kernel/fs/vfs.cpp +++ b/src/system/kernel/fs/vfs.cpp @@ -5156,12 +5156,15 @@ fix_dirent(struct vnode *parent, struct dirent *userEntry, struct dirent* entry; if (IS_USER_ADDRESS(userEntry)) { - unsigned short length; entry = (struct dirent*)buffer; - if (user_memcpy(&length, &userEntry->d_reclen, sizeof(length)) != B_OK - || user_memcpy(entry, userEntry, length) != B_OK) + if (user_memcpy(entry, userEntry, sizeof(struct dirent) - 1) != B_OK) return B_BAD_ADDRESS; + ASSERT(entry->d_reclen >= sizeof(struct dirent)); + + if (user_memcpy(entry->d_name, userEntry->d_name, + entry->d_reclen - sizeof(struct dirent)) != B_OK) + return B_BAD_ADDRESS; } else entry = userEntry;