rootfs: Fix wrong comparison for buffer reuse on rename.

The comparison to decide whether or not to reuse the name buffer when
renaming a rootfs entry was reversed. For renames where the new name
was longer than the old one this resulted in writing beyond the name
buffer and corrupting random kernel memory.

A likely candidate for this to be triggered was when a audio cd was
renamed due to a CDDB lookup, as the placeholder "Audio CD" is quite
short and the actual CD name is usually longer.

Fixes: #10259. Possibly fixes the related #9528 and #9858.
This commit is contained in:
Michael Lotz
2015-03-28 12:18:29 +01:00
parent 3dc2b74b6f
commit 3384ca1a7b
+1 -1
View File
@@ -955,7 +955,7 @@ rootfs_rename(fs_volume* _volume, fs_vnode* _fromDir, const char* fromName,
}
// we try to reuse the existing name buffer if possible
if (strlen(fromName) >= strlen(toName)) {
if (strlen(fromName) < strlen(toName)) {
char* nameBuffer = strdup(toName);
if (nameBuffer == NULL)
return B_NO_MEMORY;