Page MenuHomeFreeBSD

fusefs: fix a buffer overflow in the tests
ClosedPublic

Authored by asomers on Feb 22 2023, 12:34 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Nov 11, 12:39 AM
Unknown Object (File)
Tue, Nov 11, 12:39 AM
Unknown Object (File)
Tue, Nov 11, 12:39 AM
Unknown Object (File)
Tue, Nov 11, 12:39 AM
Unknown Object (File)
Mon, Nov 10, 8:59 PM
Unknown Object (File)
Thu, Nov 6, 10:49 PM
Unknown Object (File)
Wed, Nov 5, 7:16 AM
Unknown Object (File)
Tue, Nov 4, 6:47 PM
Subscribers

Details

Summary

The actual overflow occured in the ReadAhead.readahead test.
Surprisingly it has never segfaulted or resulted in any bad behavior.

MFC after: 1 week
Sponsored by: Axcient

Test Plan

Added assertions to existing tests

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

tests/sys/fs/fusefs/io.cc
144

should this be sizeof(in.body-bytes) - sizeof(struct fuse_write_in) or so?
and another similar case or two

tests/sys/fs/fusefs/io.cc
144

Yes.

  • Fix size comparisons during FUSE_WRITE
  • Add another size check in bmap.cc
This revision is now accepted and ready to land.Feb 22 2023, 4:19 PM
This revision was automatically updated to reflect the committed changes.