You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
37 lines
1.3 KiB
37 lines
1.3 KiB
From 945e47e2fcc5d1cec693122286da06d8ab829c52 Mon Sep 17 00:00:00 2001 |
|
From: "Darrick J. Wong" <darrick.wong@oracle.com> |
|
Date: Thu, 4 Jan 2018 13:58:29 -0600 |
|
Subject: [PATCH] xfs_db: fix crash when field list selector string has |
|
trailing slash |
|
|
|
If I run the following command: |
|
|
|
xfs_db /dev/sdf -x -c 'agf 0' -c 'addr refcntroot' -c 'addr ptrs[1]\' |
|
|
|
it errors out with "bad character in field \" and |
|
then ftok_free crashes on an invalid free() because picking up the |
|
previous token (the closing bracket) xrealloc'd the token array to be 5 |
|
elements long but never set the last element's tok pointer. |
|
Consequently the ftok_free tries to free whatever garbage pointer is in |
|
that last element and kaboom. |
|
|
|
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> |
|
Reviewed-by: Eric Sandeen <sandeen@sandeen.net> |
|
[sandeen: slightly clarify commit log] |
|
Signed-off-by: Eric Sandeen <sandeen@sandeen.net> |
|
--- |
|
db/flist.c | 1 + |
|
1 file changed, 1 insertion(+) |
|
|
|
Index: xfsprogs-4.5.0/db/flist.c |
|
=================================================================== |
|
--- xfsprogs-4.5.0.orig/db/flist.c |
|
+++ xfsprogs-4.5.0/db/flist.c |
|
@@ -400,6 +400,7 @@ flist_split( |
|
strncpy(a, s, l); |
|
a[l] = '\0'; |
|
v = xrealloc(v, (nv + 2) * sizeof(*v)); |
|
+ v[nv + 1].tok = NULL; |
|
v[nv].tok = a; |
|
v[nv].tokty = t; |
|
nv++;
|
|
|