Fix possible crash in nfs_block readdir

This commit is contained in:
Vitaliy Filippov
2024-12-01 18:04:49 +03:00
parent 2105f4b654
commit 652ca631bb
+7 -4
View File
@@ -1056,11 +1056,15 @@ static void block_nfs3_readdir_common(void *opaque, rpc_op_t *rop, bool is_plus)
uint64_t idx = 1;
void *prev = NULL;
for (auto it = entries.begin(); it != entries.end();)
{
if (args->cookie > 0 && idx <= args->cookie)
entries.erase(it++);
else
{
entryplus3 *entry = &it->second;
// First fields of entry3 and entryplus3 are the same: fileid, name, cookie
entry->name = xdr_copy_string(rop->xdrs, it->first);
entry->cookie = idx++;
entry->cookie = idx;
if (prev)
{
if (is_plus)
@@ -1069,11 +1073,10 @@ static void block_nfs3_readdir_common(void *opaque, rpc_op_t *rop, bool is_plus)
((entry3*)prev)->nextentry = (entry3*)entry;
}
prev = entry;
if (args->cookie > 0 && entry->cookie == args->cookie)
entries.erase(entries.begin(), ++it);
else
it++;
}
idx++;
}
// Now limit results based on maximum reply size
// Sadly we have to calculate reply size by hand
// reply without entries is 4+4+(dir_attributes ? sizeof(fattr3) : 0)+8+4 bytes