thebestvibedev/tromcho.net
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix possible crash in nfs_block readdir

Browse Source
This commit is contained in:
Vitaliy Filippov
2024-12-01 18:04:49 +03:00
parent 2105f4b654
commit 652ca631bb
1 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nfs/nfs_block.cpp
+7 -4
View File
@@ -1056,11 +1056,15 @@ static void block_nfs3_readdir_common(void *opaque, rpc_op_t *rop, bool is_plus)
uint64_t idx = 1; uint64_t idx = 1;
void *prev = NULL; void *prev = NULL;
for (auto it = entries.begin(); it != entries.end();) for (auto it = entries.begin(); it != entries.end();)
{
if (args->cookie > 0 && idx <= args->cookie)
entries.erase(it++);
else
{ {
entryplus3 *entry = &it->second; entryplus3 *entry = &it->second;
// First fields of entry3 and entryplus3 are the same: fileid, name, cookie // First fields of entry3 and entryplus3 are the same: fileid, name, cookie
entry->name = xdr_copy_string(rop->xdrs, it->first); entry->name = xdr_copy_string(rop->xdrs, it->first);
entry->cookie = idx++; entry->cookie = idx;
if (prev) if (prev)
{ {
if (is_plus) if (is_plus)
@@ -1069,11 +1073,10 @@ static void block_nfs3_readdir_common(void *opaque, rpc_op_t *rop, bool is_plus)
((entry3*)prev)->nextentry = (entry3*)entry; ((entry3*)prev)->nextentry = (entry3*)entry;
} }
prev = entry; prev = entry;
if (args->cookie > 0 && entry->cookie == args->cookie)
entries.erase(entries.begin(), ++it);
else
it++; it++;
} }
idx++;
}
// Now limit results based on maximum reply size // Now limit results based on maximum reply size
// Sadly we have to calculate reply size by hand // Sadly we have to calculate reply size by hand
// reply without entries is 4+4+(dir_attributes ? sizeof(fattr3) : 0)+8+4 bytes // reply without entries is 4+4+(dir_attributes ? sizeof(fattr3) : 0)+8+4 bytes