Messages in this thread | | | Date | Mon, 22 Dec 2008 13:58:56 -0600 | From | Tyler Hicks <> | Subject | Re: [PATCH, v5] eCryptfs: check readlink result was not an error before using it |
| |
Duane Griffin wrote: > The result from readlink is being used to index into the link name > buffer without checking whether it is a valid length. If readlink > returns an error this will fault or cause memory corruption. > > Cc: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Acked-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
> Cc: Dustin Kirkland <kirkland@canonical.com> > Cc: ecryptfs-devel@lists.launchpad.net > Signed-off-by: Duane Griffin <duaneg@dghda.com> > Acked-by: Michael Halcrow <mhalcrow@us.ibm.com> > --- > > Unchanged from original version. > > fs/ecryptfs/inode.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c > index 89209f0..5e78fc1 100644 > --- a/fs/ecryptfs/inode.c > +++ b/fs/ecryptfs/inode.c > @@ -673,10 +673,11 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd) > ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ " > "dentry->d_name.name = [%s]\n", dentry->d_name.name); > rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); > - buf[rc] = '\0'; > set_fs(old_fs); > if (rc < 0) > goto out_free; > + else > + buf[rc] = '\0'; > rc = 0; > nd_set_link(nd, buf); > goto out;
[unhandled content-type:application/pgp-signature] | |