Page MenuHomeFreeBSD

fusefs: fix a buffer overflow in the tests
ClosedPublic

Authored by asomers on Feb 22 2023, 12:34 AM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Mar 10, 1:52 AM
Unknown Object (File)
Tue, Mar 4, 10:49 PM
Unknown Object (File)
Mon, Mar 3, 6:33 PM
Unknown Object (File)
Sat, Feb 22, 2:40 AM
Unknown Object (File)
Thu, Feb 20, 10:09 PM
Unknown Object (File)
Thu, Feb 20, 3:06 AM
Unknown Object (File)
Feb 7 2025, 3:19 AM
Unknown Object (File)
Dec 28 2024, 9:31 AM
Subscribers

Details

Summary

The actual overflow occured in the ReadAhead.readahead test.
Surprisingly it has never segfaulted or resulted in any bad behavior.

MFC after: 1 week
Sponsored by: Axcient

Test Plan

Added assertions to existing tests

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 49964
Build 46856: arc lint + arc unit

Event Timeline

tests/sys/fs/fusefs/io.cc
144

should this be sizeof(in.body-bytes) - sizeof(struct fuse_write_in) or so?
and another similar case or two

tests/sys/fs/fusefs/io.cc
144

Yes.

  • Fix size comparisons during FUSE_WRITE
  • Add another size check in bmap.cc
This revision is now accepted and ready to land.Feb 22 2023, 4:19 PM
This revision was automatically updated to reflect the committed changes.