From 3384ca1a7b852b42482be3649c9880e183a86720 Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Sat, 28 Mar 2015 12:04:38 +0100 Subject: [PATCH] rootfs: Fix wrong comparison for buffer reuse on rename. The comparison to decide whether or not to reuse the name buffer when renaming a rootfs entry was reversed. For renames where the new name was longer than the old one this resulted in writing beyond the name buffer and corrupting random kernel memory. A likely candidate for this to be triggered was when a audio cd was renamed due to a CDDB lookup, as the placeholder "Audio CD" is quite short and the actual CD name is usually longer. Fixes: #10259. Possibly fixes the related #9528 and #9858. --- src/system/kernel/fs/rootfs.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/system/kernel/fs/rootfs.cpp b/src/system/kernel/fs/rootfs.cpp index 9d00152d76..5bfb782fa7 100644 --- a/src/system/kernel/fs/rootfs.cpp +++ b/src/system/kernel/fs/rootfs.cpp @@ -955,7 +955,7 @@ rootfs_rename(fs_volume* _volume, fs_vnode* _fromDir, const char* fromName, } // we try to reuse the existing name buffer if possible - if (strlen(fromName) >= strlen(toName)) { + if (strlen(fromName) < strlen(toName)) { char* nameBuffer = strdup(toName); if (nameBuffer == NULL) return B_NO_MEMORY;