Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2025-02-27 04:47:20 +00:00
Code Issues Projects Releases Packages Wiki Activity

ext4: Fix handling of direntlen in unlink_filename

Browse source 
The direntlen checks were quite bogus, i.e. the loop termination used
"len + offset == blocksize" (exact match only), and checked for a
direntlen less than 0. The latter can never happen as the len is
unsigned, this has been reported by Coverity, CID 153384.

Use the same code as in search_dir for directory traversal. This code
has the correct checks for direntlen >= sizeof(struct dirent), and
offset < blocksize.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Reported-by: Coverity (CID: 153383, 153384)
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Lukasz Majewski <l.majewski@samsung.com>
This commit is contained in:
Stefan Brüns 2016-10-09 20:15:27 +02:00 • committed by Tom Rini
parent 15bf8c4f93
commit d1bdf22461
1 changed files with 17 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
fs/ext4/ext4_common.c
View file

@ -854,16 +854,15 @@ fail:
static int unlink_filename(char *filename, unsigned int blknr) static int unlink_filename(char *filename, unsigned int blknr)
{ {
int templength = 0; int status;
int status, inodeno; int inodeno = 0;
int found = 0;
int offset; int offset;
char *block_buffer = NULL; char *block_buffer = NULL;
struct ext2_dirent *dir = NULL; struct ext2_dirent *dir = NULL;
struct ext2_dirent *previous_dir = NULL; struct ext2_dirent *previous_dir;
char *ptr = NULL;
struct ext_filesystem *fs = get_fs(); struct ext_filesystem *fs = get_fs();
int ret = -1; int ret = -1;
char *direntname;
block_buffer = zalloc(fs->blksz); block_buffer = zalloc(fs->blksz);
if (!block_buffer) if (!block_buffer)
@ -877,20 +876,18 @@ static int unlink_filename(char *filename, unsigned int blknr)
if (ext4fs_log_journal(block_buffer, blknr)) if (ext4fs_log_journal(block_buffer, blknr))
goto fail; goto fail;
dir = (struct ext2_dirent *)block_buffer;
ptr = (char *)dir;
offset = 0; offset = 0;
while (le16_to_cpu(dir->direntlen) >= 0) { do {
/* previous_dir = dir;
* blocksize-offset because last dir = (struct ext2_dirent *)(block_buffer + offset);
* directory length i.e., *dir->direntlen direntname = (char *)(dir) + sizeof(struct ext2_dirent);
* is free availble space in the block that
* means it is a last entry of directory entry int direntlen = le16_to_cpu(dir->direntlen);
*/ if (direntlen < sizeof(struct ext2_dirent))
break;
if (dir->inode && (strlen(filename) == dir->namelen) && if (dir->inode && (strlen(filename) == dir->namelen) &&
(strncmp(ptr + sizeof(struct ext2_dirent), (strncmp(direntname, filename, dir->namelen) == 0)) {
filename, dir->namelen) == 0)) {
printf("file found, deleting\n");
inodeno = le32_to_cpu(dir->inode); inodeno = le32_to_cpu(dir->inode);
if (previous_dir) { if (previous_dir) {
uint16_t new_len; uint16_t new_len;
@ -900,23 +897,15 @@ static int unlink_filename(char *filename, unsigned int blknr)
} else { } else {
dir->inode = 0; dir->inode = 0;
} }
found = 1;
break; break;
} }
if (fs->blksz - offset == le16_to_cpu(dir->direntlen)) offset += direntlen;
break;
/* traversing the each directory entry */ } while (offset < fs->blksz);
templength = le16_to_cpu(dir->direntlen);
offset = offset + templength;
previous_dir = dir;
dir = (struct ext2_dirent *)((char *)dir + templength);
ptr = (char *)dir;
}
if (inodeno > 0) {
if (found == 1) {
if (ext4fs_put_metadata(block_buffer, blknr)) if (ext4fs_put_metadata(block_buffer, blknr))
goto fail; goto fail;
ret = inodeno; ret = inodeno;