Messages in this thread Patch in this message | | | From | "H. Peter Anvin" <> | Subject | autofs (< 2.2.1) security fix | Date | Sat, 20 Feb 1999 19:34:24 -0800 (PST) |
| |
This fixes the buffer overrun problem in autofs that was recently reported.
-hpa
diff -ur stock/linux-2.2.2-pre5/fs/autofs/root.c linux-2.2.2-pre5/fs/autofs/root.c --- stock/linux-2.2.2-pre5/fs/autofs/root.c Mon Jan 11 15:03:30 1999 +++ linux-2.2.2-pre5/fs/autofs/root.c Sat Feb 20 18:53:53 1999 @@ -209,7 +209,7 @@ NULL, /* d_compare */ }; -static int autofs_root_lookup(struct inode *dir, struct dentry * dentry) +static int autofs_root_lookup(struct inode *dir, struct dentry *dentry) { struct autofs_sb_info *sbi; int oz_mode; @@ -220,6 +220,9 @@ if (!S_ISDIR(dir->i_mode)) return -ENOTDIR; + if (dentry->d_name.len > NAME_MAX) + return -ENOENT; /* File name too long to exist */ + sbi = autofs_sbi(dir->i_sb); oz_mode = autofs_oz_mode(sbi); @@ -280,6 +283,9 @@ if ( !autofs_oz_mode(sbi) ) return -EPERM; + if ( dentry->d_name.len > NAME_MAX ) + return -ENAMETOOLONG; + if ( autofs_hash_lookup(dh, &dentry->d_name) ) return -EEXIST; @@ -400,6 +406,9 @@ if ( !autofs_oz_mode(sbi) ) return -EPERM; + + if ( dentry->d_name.len > NAME_MAX ) + return -ENAMETOOLONG; ent = autofs_hash_lookup(dh, &dentry->d_name); if ( ent ) diff -ur stock/linux-2.2.2-pre5/fs/autofs/waitq.c linux-2.2.2-pre5/fs/autofs/waitq.c --- stock/linux-2.2.2-pre5/fs/autofs/waitq.c Mon Jan 11 15:03:30 1999 +++ linux-2.2.2-pre5/fs/autofs/waitq.c Sat Feb 20 19:26:21 1999 @@ -99,13 +99,17 @@ autofs_catatonic_mode(sbi); } -int autofs_wait(struct autofs_sb_info *sbi, struct qstr * name) +int autofs_wait(struct autofs_sb_info *sbi, struct qstr *name) { struct autofs_wait_queue *wq; int status; /* In catatonic mode, we don't wait for nobody */ if ( sbi->catatonic ) + return -ENOENT; + + /* We shouldn't be able to get here, but just in case */ + if ( name->len > NAME_MAX ) return -ENOENT; for ( wq = sbi->queues ; wq ; wq = wq->next ) { - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |