Page MenuHomeFreeBSD

fusefs: fix a buffer overflow in the tests
ClosedPublic

Authored by asomers on Feb 22 2023, 12:34 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Sep 8, 9:08 PM
Unknown Object (File)
Thu, Sep 3, 9:49 AM
Unknown Object (File)
Thu, Aug 27, 2:41 AM
Unknown Object (File)
Wed, Aug 26, 12:27 AM
Unknown Object (File)
Sat, Aug 22, 12:05 PM
Unknown Object (File)
Wed, Aug 19, 10:03 AM
Unknown Object (File)
Aug 14 2026, 7:42 AM
Unknown Object (File)
Aug 14 2026, 7:15 AM
Subscribers

Details

Summary

The actual overflow occured in the ReadAhead.readahead test.
Surprisingly it has never segfaulted or resulted in any bad behavior.

MFC after: 1 week
Sponsored by: Axcient

Test Plan

Added assertions to existing tests

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 49939
Build 46831: arc lint + arc unit

Event Timeline

tests/sys/fs/fusefs/io.cc
144

should this be sizeof(in.body-bytes) - sizeof(struct fuse_write_in) or so?
and another similar case or two

tests/sys/fs/fusefs/io.cc
144

Yes.

  • Fix size comparisons during FUSE_WRITE
  • Add another size check in bmap.cc
This revision is now accepted and ready to land.Feb 22 2023, 4:19 PM
This revision was automatically updated to reflect the committed changes.