svn commit: r363672 - stable/12/usr.sbin/mountd

[Brooks Davis]

Author: brooks
Date: Wed Jul 29 20:30:15 2020
New Revision: 363672
URL: https://svnweb.freebsd.org/changeset/base/363672

Log:
  MFC r363435:
  
  Avoid reading one byte before the path buffer.
  
  This happens when there's only one component (e.g. "/foo"). This
  (mostly-harmless) bug has been present since June 1990 when it was
  commited to mountd.c SCCS version 5.9.
  
  Note: the bug is on the second changed line, the first line is changed
  for visual consistency.
  
  Reviewed by:	cem, emaste, mckusick, rmacklem
  Reported by:	CHERI
  Obtained from:	CheriBSD
  Sponsored by:	DARPA
  Differential Revision:	https://reviews.freebsd.org/D25759

Modified:
  stable/12/usr.sbin/mountd/mountd.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/usr.sbin/mountd/mountd.c
==============================================================================
--- stable/12/usr.sbin/mountd/mountd.c	Wed Jul 29 19:38:49 2020	(r363671)
+++ stable/12/usr.sbin/mountd/mountd.c	Wed Jul 29 20:30:15 2020	(r363672)
@@ -3140,9 +3140,9 @@ do_mount(struct exportlist *ep, struct grouplist *grp,
 					goto error_exit;
 				}
 				/* back up over the last component */
-				while (*cp == '/' && cp > dirp)
+				while (cp > dirp && *cp == '/')
 					cp--;
-				while (*(cp - 1) != '/' && cp > dirp)
+				while (cp > dirp && *(cp - 1) != '/')
 					cp--;
 				if (cp == dirp) {
 					if (debug)