i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix null deref; include \0 when copying paths

Browse Source 
git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@17662 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
François Revol
2006-05-31 00:01:01 +00:00
parent 373d946f22
commit 84aae13f6d
1 changed files with 7 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/system/kernel/fs/devfs.cpp
+7 -12
View File
@@ -1580,13 +1580,13 @@ devfs_ioctl(fs_volume _fs, fs_vnode _vnode, fs_cookie _cookie, ulong op,
case B_GET_DRIVER_FOR_DEVICE: case B_GET_DRIVER_FOR_DEVICE:
{ {
const char *dpath; const char *dpath;
if (!S_ISCHR(vnode->stream.type)) if (!vnode->stream.u.dev.driver)
return B_NOT_ALLOWED; return B_ENTRY_NOT_FOUND;
dpath = vnode->stream.u.dev.driver->path; dpath = vnode->stream.u.dev.driver->path;
if (!dpath) if (!dpath)
return B_ENTRY_NOT_FOUND; return B_ENTRY_NOT_FOUND;
// should make sure it's \0 terminated on truncation // should make sure it's \0 terminated on truncation
return user_memcpy(buffer, dpath, strnlen(dpath, 256)); return user_memcpy(buffer, dpath, strnlen(dpath, 255)+1);
} }
case B_GET_PARTITION_INFO: case B_GET_PARTITION_INFO:
@@ -1605,20 +1605,15 @@ devfs_ioctl(fs_volume _fs, fs_vnode _vnode, fs_cookie _cookie, ulong op,
case B_GET_PATH_FOR_DEVICE: case B_GET_PATH_FOR_DEVICE:
{ {
const char *dmp = "/dev/"; char path[256];
KPath path(dmp);
char *pbuf;
status_t err; status_t err;
/* XXX: we might want to actually find the mountpoint /* XXX: we might want to actually find the mountpoint
* of that instance of devfs... * of that instance of devfs...
* but for now we assume it's mounted on /dev * but for now we assume it's mounted on /dev
*/ */
if (path.InitCheck() != B_OK) strcpy(path, "/dev/");
return B_NO_MEMORY; get_device_name(vnode, path+5, sizeof(path)-5);
pbuf = path.LockBuffer(); err = user_memcpy(buffer, path, strnlen(path, sizeof(path)-1)+1);
get_device_name(vnode, pbuf+strlen(dmp), path.BufferSize()-strlen(dmp));
err = user_memcpy(buffer, pbuf, strnlen(pbuf, 256));
path.UnlockBuffer();
return err; return err;
} }