From 91b4626a782adfdd150002cf824cd26b97f4f83a Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Sun, 28 Apr 2013 13:33:05 +0200 Subject: [PATCH] Check for and report an error on key buffer overrun. This usually wasn't a problem as the key buffer is generally large enough to hold a single value. Still on short buffers or very long it could have silently overrun before. --- .../kernel/file_systems/bfs/BPlusTree.cpp | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/src/add-ons/kernel/file_systems/bfs/BPlusTree.cpp b/src/add-ons/kernel/file_systems/bfs/BPlusTree.cpp index df5d999206..70c9608cbe 100644 --- a/src/add-ons/kernel/file_systems/bfs/BPlusTree.cpp +++ b/src/add-ons/kernel/file_systems/bfs/BPlusTree.cpp @@ -2663,15 +2663,20 @@ TreeIterator::Traverse(int8 direction, void* key, uint16* keyLength, RETURN_ERROR(B_BAD_DATA); } - length = min_c(length, maxLength); + // include the termination for string types + bool needsTermination = fTree->fHeader.DataType() == BPLUSTREE_STRING_TYPE; + if (length + (needsTermination ? 1 : 0) > maxLength) { + // the buffer is too small, restore the last key and return an error + fCurrentNodeOffset = savedNodeOffset; + fCurrentKey = savedKey; + return B_BUFFER_OVERFLOW; + } + memcpy(key, keyStart, length); - if (fTree->fHeader.DataType() == BPLUSTREE_STRING_TYPE) { - // terminate string type - if (length == maxLength) - length--; + if (needsTermination) ((char*)key)[length] = '\0'; - } + *keyLength = length; off_t offset = BFS_ENDIAN_TO_HOST_INT64(node->Values()[fCurrentKey]);