A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 21:54:34 -04:00
Code Issues Projects Releases Packages Wiki Activity

UPSTREAM: ANDROID: fuse-bpf: Fix filldir

Browse source 
filldir used strcpy, potentially leading to writing the ending null past
the current page. fuse_dirents are not null terminated, so we switch to
using memcpy to avoid adding an extraneous null, which would be
overwritten if the name was already byte aligned.

Bug: 217570523
Test: generic/027
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Change-Id: Ic5d1f1887a113e1a3319998bad47cfbac3d90baa
This commit is contained in:
Daniel Rosenberg 2022-02-15 15:57:14 -08:00 • committed by Alexander Martinz
commit e501cd2814
No known key found for this signature in database
GPG key ID: CF15BDD9A321A9B2
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
fs/fuse/backing.c
View file

@ -191,7 +191,8 @@ void *fuse_open_finalize(struct fuse_args *fa,
struct fuse_file *ff = file->private_data;
struct fuse_open_out *foo = fa->out_args[0].value;
ff->fh = foo->fh;
if (ff)
ff->fh = foo->fh;
return 0;
}
@ -1987,7 +1988,7 @@ static int filldir(struct dir_context *ctx, const char *name, int namelen,
.type = d_type,
};
strcpy(fd->name, name);
memcpy(fd->name, name, namelen);
ec->offset += FUSE_DIRENT_SIZE(fd);
return 0;