[v2] Btrfs-progs: set string end sing '\0' for property
diff mbox

Message ID 1398422643-6741-1-git-send-email-bo.li.liu@oracle.com
State Accepted
Delegated to: David Sterba
Headers show

Commit Message

Liu Bo April 25, 2014, 10:44 a.m. UTC
Set string "xattr_name" 's end with '\0' so that it won't be
violated in memory.

With this fix, xfstest/btrfs/048 can pass on my box.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
v2: avoid buffer overflow of malloc().

 props.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

Comments

Filipe Manana April 25, 2014, 10:51 a.m. UTC | #1
On Fri, Apr 25, 2014 at 11:44 AM, Liu Bo <bo.li.liu@oracle.com> wrote:
> Set string "xattr_name" 's end with '\0' so that it won't be
> violated in memory.
>
> With this fix, xfstest/btrfs/048 can pass on my box.
>
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>

Reviewed-by: Filipe Manana <fdmanana@gmail.com>

> ---
> v2: avoid buffer overflow of malloc().
>
>  props.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/props.c b/props.c
> index 9ff63ca..cc87454 100644
> --- a/props.c
> +++ b/props.c
> @@ -131,13 +131,14 @@ static int prop_compression(enum prop_object_type type,
>                 goto out;
>         }
>
> -       xattr_name = malloc(XATTR_BTRFS_PREFIX_LEN + strlen(name));
> +       xattr_name = malloc(XATTR_BTRFS_PREFIX_LEN + strlen(name) + 1);
>         if (!xattr_name) {
>                 ret = -ENOMEM;
>                 goto out;
>         }
>         memcpy(xattr_name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN);
>         memcpy(xattr_name + XATTR_BTRFS_PREFIX_LEN, name, strlen(name));
> +       xattr_name[XATTR_BTRFS_PREFIX_LEN + strlen(name)] = '\0';
>
>         if (value)
>                 sret = fsetxattr(fd, xattr_name, value, strlen(value), 0);
> --
> 1.7.7
>

Patch
diff mbox

diff --git a/props.c b/props.c
index 9ff63ca..cc87454 100644
--- a/props.c
+++ b/props.c
@@ -131,13 +131,14 @@  static int prop_compression(enum prop_object_type type,
 		goto out;
 	}
 
-	xattr_name = malloc(XATTR_BTRFS_PREFIX_LEN + strlen(name));
+	xattr_name = malloc(XATTR_BTRFS_PREFIX_LEN + strlen(name) + 1);
 	if (!xattr_name) {
 		ret = -ENOMEM;
 		goto out;
 	}
 	memcpy(xattr_name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN);
 	memcpy(xattr_name + XATTR_BTRFS_PREFIX_LEN, name, strlen(name));
+	xattr_name[XATTR_BTRFS_PREFIX_LEN + strlen(name)] = '\0';
 
 	if (value)
 		sret = fsetxattr(fd, xattr_name, value, strlen(value), 0);