[PATCH 2/6] Avoid overflowing name buffer in deep directory structures
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: 2016-06-15 22:43:03
Subsystem:
the rest · Maintainer:
Linus Torvalds
This just makes sure that when we do a read_directory(), we check that the filename fits in the buffer we allocated (with a bit of slop) Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> --- dir.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/dir.c b/dir.c
index 7426fde..4f5a224 100644
--- a/dir.c
+++ b/dir.c@@ -353,6 +353,9 @@ static int read_directory_recursive(struct dir_struct *dir, const char *path, co !strcmp(de->d_name + 1, "git"))) continue; len = strlen(de->d_name); + /* Ignore overly long pathnames! */ + if (len + baselen + 8 > sizeof(fullname)) + continue; memcpy(fullname + baselen, de->d_name, len+1); if (simplify_away(fullname, baselen + len, simplify)) continue;
--
1.5.1.110.g1e4c