Fix possible crash in nfs_block readdir
This commit is contained in:
+17
-14
@@ -1057,22 +1057,25 @@ static void block_nfs3_readdir_common(void *opaque, rpc_op_t *rop, bool is_plus)
|
|||||||
void *prev = NULL;
|
void *prev = NULL;
|
||||||
for (auto it = entries.begin(); it != entries.end();)
|
for (auto it = entries.begin(); it != entries.end();)
|
||||||
{
|
{
|
||||||
entryplus3 *entry = &it->second;
|
if (args->cookie > 0 && idx <= args->cookie)
|
||||||
// First fields of entry3 and entryplus3 are the same: fileid, name, cookie
|
entries.erase(it++);
|
||||||
entry->name = xdr_copy_string(rop->xdrs, it->first);
|
|
||||||
entry->cookie = idx++;
|
|
||||||
if (prev)
|
|
||||||
{
|
|
||||||
if (is_plus)
|
|
||||||
((entryplus3*)prev)->nextentry = entry;
|
|
||||||
else
|
|
||||||
((entry3*)prev)->nextentry = (entry3*)entry;
|
|
||||||
}
|
|
||||||
prev = entry;
|
|
||||||
if (args->cookie > 0 && entry->cookie == args->cookie)
|
|
||||||
entries.erase(entries.begin(), ++it);
|
|
||||||
else
|
else
|
||||||
|
{
|
||||||
|
entryplus3 *entry = &it->second;
|
||||||
|
// First fields of entry3 and entryplus3 are the same: fileid, name, cookie
|
||||||
|
entry->name = xdr_copy_string(rop->xdrs, it->first);
|
||||||
|
entry->cookie = idx;
|
||||||
|
if (prev)
|
||||||
|
{
|
||||||
|
if (is_plus)
|
||||||
|
((entryplus3*)prev)->nextentry = entry;
|
||||||
|
else
|
||||||
|
((entry3*)prev)->nextentry = (entry3*)entry;
|
||||||
|
}
|
||||||
|
prev = entry;
|
||||||
it++;
|
it++;
|
||||||
|
}
|
||||||
|
idx++;
|
||||||
}
|
}
|
||||||
// Now limit results based on maximum reply size
|
// Now limit results based on maximum reply size
|
||||||
// Sadly we have to calculate reply size by hand
|
// Sadly we have to calculate reply size by hand
|
||||||
|
|||||||
Reference in New Issue
Block a user