PERFORCE change 20859 for review

[Brian Feldman]

http://perforce.freebsd.org/chv.cgi?CH=20859

Change 20859 by green at green_laptop_2 on 2002/11/08 10:46:32

	* Update the errors from the previous submission to be EIO now.
	* Add a few more consistency checks.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/ufs/ffs/ffs_vnops.c#17 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/ufs/ffs/ffs_vnops.c#17 (text+ko) ====

@@ -1328,8 +1328,8 @@
     int *ealenp, u_char **eap, u_char **eac)
 {
 	u_char *p, *pe, *pn, *p0;
-	int eapad1, eapad2, ealength, ealen, nlen;
-	uint32_t ul;
+	int eapad1, ealength, ealen, nlen;
+	uint32_t ul, eapad2;
 
 	pe = ptr + length;
 	nlen = strlen(name);
@@ -1340,19 +1340,23 @@
 		pn = p + ul;
 		/* make sure this entry is complete */
 		if (pn > pe)
-			break;
+			return (EIO);
 		/* don't loop forever on a corrupt entry */
 		if (pn <= p)
-			return (EFTYPE);
+			return (EIO);
 		p += sizeof(uint32_t);
 		if (*p != nspace)
 			continue;
 		p++;
 		eapad2 = *p++;
+		/* padding is at most 7 bytes */
+		if (eapad2 >= 8)
+			return (EIO);
 		if (*p != nlen)
 			continue;
 		p++;
-		if (bcmp(p, name, nlen))
+		/* compare only up to the end of this attribute */
+		if (p + nlen > pn || bcmp(p, name, nlen))
 			continue;
 		ealength = sizeof(uint32_t) + 3 + nlen;
 		eapad1 = 8 - (ealength % 8);
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message