rootfs: Fix wrong comparison for buffer reuse on rename.
The comparison to decide whether or not to reuse the name buffer when renaming a rootfs entry was reversed. For renames where the new name was longer than the old one this resulted in writing beyond the name buffer and corrupting random kernel memory. A likely candidate for this to be triggered was when a audio cd was renamed due to a CDDB lookup, as the placeholder "Audio CD" is quite short and the actual CD name is usually longer. Fixes: #10259. Possibly fixes the related #9528 and #9858.
This commit is contained in:
@@ -955,7 +955,7 @@ rootfs_rename(fs_volume* _volume, fs_vnode* _fromDir, const char* fromName,
|
||||
}
|
||||
|
||||
// we try to reuse the existing name buffer if possible
|
||||
if (strlen(fromName) >= strlen(toName)) {
|
||||
if (strlen(fromName) < strlen(toName)) {
|
||||
char* nameBuffer = strdup(toName);
|
||||
if (nameBuffer == NULL)
|
||||
return B_NO_MEMORY;
|
||||
|
||||
Reference in New Issue
Block a user