From patchwork Wed Aug 25 16:50:32 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adhemerval Zanella X-Patchwork-Id: 44795 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 2535A385AC22 for ; Wed, 25 Aug 2021 16:51:08 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 2535A385AC22 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1629910268; bh=JtoG9EBtJTY7Dj5poelFJ6nfu7wn6HeDrTd8aWiEsMs=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=jWLwKwQUa9MIWXy5Oi4+kbRQ9o4cFVE6ep/TME/slD9JUQ+feRN4Fmm0otgUO7Ntw iWogUROhg+O+cBY+S+pcgZ5j+jJQzHFlXhAMBbYodHxHffu6GnsKwkZXz1/tIupxg4 LcAnD83iL2GRxZ3mrgbuOcegbSL2nTEMrNmUvxu0= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-qv1-xf2d.google.com (mail-qv1-xf2d.google.com [IPv6:2607:f8b0:4864:20::f2d]) by sourceware.org (Postfix) with ESMTPS id 095093857829 for ; Wed, 25 Aug 2021 16:50:37 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 095093857829 Received: by mail-qv1-xf2d.google.com with SMTP id v1so303099qva.7 for ; Wed, 25 Aug 2021 09:50:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=JtoG9EBtJTY7Dj5poelFJ6nfu7wn6HeDrTd8aWiEsMs=; b=WreyTkEn2P21MBhOLLMObg0tvfUnXAjTV2fZAxsMZI7YD1qV+VHh53QT8+ZXf8Owbl OmtyjXefGq0YfFP/+cmw2D5hcIAiwC7hPrOjb1MPKRbMsem2r1rIpV/ZqQnVcjp/VDJl Yatb/vFjRsPqNcAyYxqcx43BEvwvMWVgQfkgKxo1Rr8CC3GRQV3L7UA/ZRRsX5GGHfK/ rYpM7EkRdQxQ2+Sv94bPhQjOfZ+uw2pqHVxPPXkL6onWoP2gdZ2ltSrCTKm9sR7NxhQA zZ5oZZ3Vo/Z+Wv+BRGOqKQ9vcL1NjKe9eH/xPtkFKVyiyH/aeyVnFaIRGCrYDOejkfyV YDmA== X-Gm-Message-State: AOAM532cJGe6fRbRnH6JHEatiCz5fEJ/j3b+5oGVd8T+X0e8wANal/q6 inxzweS5uVq+nFqwNs7K4mWay9FLk/O3iA== X-Google-Smtp-Source: ABdhPJzYveMyS2GdeqHkiErQCnB6uz0rLurejJICKd9lV9H0KnwSaEoPaVO5STR/qPnXGkjMI6xwbg== X-Received: by 2002:a05:6214:38c:: with SMTP id l12mr2510722qvy.57.1629910236406; Wed, 25 Aug 2021 09:50:36 -0700 (PDT) Received: from birita.. ([2804:431:c7ca:1a68:e3de:10e0:28dd:40db]) by smtp.gmail.com with ESMTPSA id r4sm155757qtw.5.2021.08.25.09.50.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Aug 2021 09:50:36 -0700 (PDT) To: libc-alpha@sourceware.org Subject: [PATCH v2] io: Fix ftw internal realloc buffer (BZ #28126) Date: Wed, 25 Aug 2021 13:50:32 -0300 Message-Id: <20210825165032.3730036-1-adhemerval.zanella@linaro.org> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-Spam-Status: No, score=-12.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Adhemerval Zanella via Libc-alpha From: Adhemerval Zanella Reply-To: Adhemerval Zanella Cc: michael.debertol@gmail.com Errors-To: libc-alpha-bounces+patchwork=sourceware.org@sourceware.org Sender: "Libc-alpha" The 106ff08526d3ca did not take in consideration the buffer might be reallocated if the total path is larger than PATH_MAX. The realloc uses 'dirbuf', where 'dirstreams' is the allocated buffer. Checked on x86_64-linux-gnu. --- io/Makefile | 1 + io/ftw.c | 13 +++++--- io/tst-ftw-bz28126.c | 79 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 88 insertions(+), 5 deletions(-) create mode 100644 io/tst-ftw-bz28126.c diff --git a/io/Makefile b/io/Makefile index 9871ecbc74..ecf65aba60 100644 --- a/io/Makefile +++ b/io/Makefile @@ -79,6 +79,7 @@ tests := test-utime test-stat test-stat2 test-lfs tst-getcwd \ tst-futimens \ tst-utimensat \ tst-closefrom \ + tst-ftw-bz28126 tests-time64 := \ tst-futimens-time64 \ diff --git a/io/ftw.c b/io/ftw.c index ce1c6a14a3..738c782bc2 100644 --- a/io/ftw.c +++ b/io/ftw.c @@ -392,13 +392,16 @@ process_entry (struct ftw_data *data, struct dir_data *dir, const char *name, if (data->dirbufsize < new_buflen) { /* Enlarge the buffer. */ - char *newp; - - data->dirbufsize = 2 * new_buflen; - newp = (char *) realloc (data->dirbuf, data->dirbufsize); + size_t newsize = 2 * new_buflen; + void *newp = realloc (data->dirstreams, data->maxdir + * sizeof (struct dir_data *) + + data->dirbufsize); if (newp == NULL) return -1; - data->dirbuf = newp; + data->dirstreams = newp; + data->dirbufsize = newsize; + data->dirbuf = (char *) data->dirstreams + + data->maxdir * sizeof (struct dir_data *); } *((char *) __mempcpy (data->dirbuf + data->ftw.base, name, namlen)) = '\0'; diff --git a/io/tst-ftw-bz28126.c b/io/tst-ftw-bz28126.c new file mode 100644 index 0000000000..ecebe1e7c0 --- /dev/null +++ b/io/tst-ftw-bz28126.c @@ -0,0 +1,79 @@ +/* Check if internal buffer reallocation work for large paths (BZ #28126) + Copyright (C) 2021 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static int +my_func (const char *file, const struct stat *sb, int flag) +{ + return 0; +} + +static const char folder[NAME_MAX] = { [0 ... 253] = 'a', [254] = '\0' }; + +#define NSUBFOLDERS 16 + +static void +do_cleanup (void) +{ + xchdir (".."); + for (int i = 0; i < NSUBFOLDERS - 1; i++) + { + remove (folder); + xchdir (".."); + } + remove (folder); +} +#define CLEANUP_HANDLER do_cleanup + +/* Check whether stack overflow occurs. */ +static int +do_test (void) +{ + char *tempdir = support_create_temp_directory ("tst-bz28126"); + + /* Create path with various subfolders to force an internal buffer + reallocation within ntfw. */ + char *path = xasprintf ("%s/%s", tempdir, folder); + xmkdir (path, 0777); + xchdir (path); + free (path); + for (int i = 0; i < NSUBFOLDERS - 1; i++) + { + xmkdir (folder, 0777); + xchdir (folder); + } + + TEST_COMPARE (ftw (tempdir, my_func, 20), 0); + + free (tempdir); + + do_cleanup (); + + return 0; +} + +#include