Pass the length of a RockRidge attribute to the handler functions and
validate that length in each handler. If a parsing error is detected,
abort the entire parsing pass.
Details
Details
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Skipped - Unit
Tests Skipped - Build Status
Buildable 73292 Build 70175: arc lint + arc unit
Event Timeline
Comment Actions
While the previous patch in this stack fixes a reproducer from Robert, this followup patch is intended as additional robustness. With both of these I was able to still mount a FreeBSD install CD and all of the attributes reported by find /mnt -ls were the same before and after the patches.
| sys/fs/cd9660/cd9660_rrip.c | ||
|---|---|---|
| 146 | why is this not the loop initialization? | |
| sys/fs/cd9660/cd9660_rrip.c | ||
|---|---|---|
| 517–520 | Ought to have the check before p->len_id above | |
| sys/fs/cd9660/cd9660_rrip.c | ||
|---|---|---|
| 146 | Because it isn't the thing being iterated (pcomp) which would be the normal thing to set in the initializer. This is more like a TAILQ_FOREACH_SAFE(). The assignment here is more to pacify the compiler, but it isn't needed as the loop body always initializes pcompn before it can be used in the last clause. I haven't actually tried building without this assignment, perhaps modern compilers are smart enough to not warn? | |
| 517–520 | Oops, yes. | |