lkml.org 
[lkml]   [2012]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch] hfs: copying wrong data in hfs_readdir()
Smatch complains that this is copying stack data when then intent was
to copy fd.key. The way I have written it matches how hfsplus_readdir()
is implemented.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I tried to test this, but to reach the memcpy() you would need to make
one of the calls to filldir() fail and I don't know how to do that. I
think that in the original code this would cause a crash when we call
hfs_find_exit()

diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 62fc14e..f637bd5 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -162,7 +162,7 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
rd->file = filp;
list_add(&rd->list, &HFS_I(inode)->open_dir_list);
}
- memcpy(&rd->key, &fd.key, sizeof(struct hfs_cat_key));
+ memcpy(&rd->key, fd.key, sizeof(struct hfs_cat_key));
out:
hfs_find_exit(&fd);
return err;

\
 
 \ /
  Last update: 2012-06-23 12:01    [W:0.051 / U:2.416 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site