i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rootfs: Fix wrong comparison for buffer reuse on rename.

Browse Source 
The comparison to decide whether or not to reuse the name buffer when
renaming a rootfs entry was reversed. For renames where the new name
was longer than the old one this resulted in writing beyond the name
buffer and corrupting random kernel memory.

A likely candidate for this to be triggered was when a audio cd was
renamed due to a CDDB lookup, as the placeholder "Audio CD" is quite
short and the actual CD name is usually longer.

Fixes: #10259. Possibly fixes the related #9528 and #9858.
This commit is contained in:
Michael Lotz
2015-03-28 12:18:29 +01:00
parent 3dc2b74b6f
commit 3384ca1a7b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/system/kernel/fs/rootfs.cpp
+1 -1
View File
@@ -955,7 +955,7 @@ rootfs_rename(fs_volume* _volume, fs_vnode* _fromDir, const char* fromName,
} }
// we try to reuse the existing name buffer if possible // we try to reuse the existing name buffer if possible
if (strlen(fromName) >= strlen(toName)) { if (strlen(fromName) < strlen(toName)) {
char* nameBuffer = strdup(toName); char* nameBuffer = strdup(toName);
if (nameBuffer == NULL) if (nameBuffer == NULL)
return B_NO_MEMORY; return B_NO_MEMORY;