Change to strnlen() and strncpy() to avoid problems from unbounded strings

[yaffs2.git] / yaffs_guts.c

diff --git a/yaffs_guts.c b/yaffs_guts.c
index 40b7948ca6c929c16de86e66378d9b3959860040..a51d82d6aa5d6df0aac9cde72dbab396bc2e564c 100644 (file)
--- a/yaffs_guts.c
+++ b/yaffs_guts.c
@@ -12,7 +12,7 @@
  */
 
 const char *yaffs_guts_c_version =
-    "$Id: yaffs_guts.c,v 1.96 2009-12-03 03:42:28 charles Exp $";
+    "$Id: yaffs_guts.c,v 1.98 2009-12-07 01:17:33 charles Exp $";
 
 #include "yportenv.h"
 
@@ -1130,7 +1130,7 @@ static void yaffs_SetObjectName(yaffs_Object *obj, const YCHAR *name)
 {
 #ifdef CONFIG_YAFFS_SHORT_NAMES_IN_RAM
        memset(obj->shortName, 0, sizeof(YCHAR) * (YAFFS_SHORT_NAME_LENGTH+1));
-       if (name && yaffs_strlen(name) <= YAFFS_SHORT_NAME_LENGTH)
+       if (name && yaffs_strnlen(name,YAFFS_SHORT_NAME_LENGTH+1) <= YAFFS_SHORT_NAME_LENGTH)
                yaffs_strcpy(obj->shortName, name);
        else
                obj->shortName[0] = _Y('\0');
@@ -2257,14 +2257,17 @@ static yaffs_Object *yaffs_FindOrCreateObjectByNumber(yaffs_Device *dev,
 static YCHAR *yaffs_CloneString(const YCHAR *str)
 {
        YCHAR *newStr = NULL;
+       int len;
 
        if (!str)
                str = _Y("");
 
-       newStr = YMALLOC((yaffs_strlen(str) + 1) * sizeof(YCHAR));
-       if (newStr)
-               yaffs_strcpy(newStr, str);
-
+       len = yaffs_strnlen(str,YAFFS_MAX_ALIAS_LENGTH);
+       newStr = YMALLOC((len + 1) * sizeof(YCHAR));
+       if (newStr){
+               yaffs_strncpy(newStr, str,len);
+               newStr[len] = 0;
+       }
        return newStr;
 
 }
@@ -2499,7 +2502,7 @@ int yaffs_RenameObject(yaffs_Object *oldDir, const YCHAR *oldName,
                force = 1;
 #endif
 
-       if(yaffs_strlen(newName) > YAFFS_MAX_NAME_LENGTH)
+       if(yaffs_strnlen(newName,YAFFS_MAX_NAME_LENGTH+1) > YAFFS_MAX_NAME_LENGTH)
                /* ENAMETOOLONG */
                return YAFFS_FAIL;
 
@@ -3135,6 +3138,7 @@ static int yaffs_GarbageCollectBlock(yaffs_Device *dev, int block,
                                        if (tags.chunkId == 0) {
                                                /* It is an object Id,
                                                 * We need to nuke the shrinkheader flags first
+                                                * Also need to clean up shadowing.
                                                 * We no longer want the shrinkHeader flag since its work is done
                                                 * and if it is left in place it will mess up scanning.
                                                 */
@@ -3143,6 +3147,9 @@ static int yaffs_GarbageCollectBlock(yaffs_Device *dev, int block,
                                                oh = (yaffs_ObjectHeader *)buffer;
                                                oh->isShrink = 0;
                                                tags.extraIsShrinkHeader = 0;
+                                               oh->shadowsObject = 0;
+                                               oh->inbandShadowsObject = 0;
+                                               tags.extraShadows = 0;
 
                                                yaffs_VerifyObjectHeader(object, oh, &tags, 1);
                                        }
@@ -5103,7 +5110,7 @@ loff_t yaffs_GetFileSize(yaffs_Object *obj)
                alias = obj->variant.symLinkVariant.alias;
                if(!alias)
                        return 0;
-               return yaffs_strlen(alias);
+               return yaffs_strnlen(alias,YAFFS_MAX_ALIAS_LENGTH);
        default:
                return 0;
        }
@@ -7087,7 +7094,7 @@ int yaffs_GetObjectName(yaffs_Object *obj, YCHAR *name, int buffSize)
        }
 #ifdef CONFIG_YAFFS_SHORT_NAMES_IN_RAM
        else if (obj->shortName[0])
-               yaffs_strcpy(name, obj->shortName);
+               yaffs_strncpy(name, obj->shortName,YAFFS_SHORT_NAME_LENGTH+1);
 #endif
        else {
                int result;
@@ -7103,11 +7110,12 @@ int yaffs_GetObjectName(yaffs_Object *obj, YCHAR *name, int buffSize)
                                                        NULL);
                }
                yaffs_strncpy(name, oh->name, buffSize - 1);
+               name[buffSize-1]=0;
 
                yaffs_ReleaseTempBuffer(obj->myDev, buffer, __LINE__);
        }
 
-       return yaffs_strlen(name);
+       return yaffs_strnlen(name,buffSize-1);
 }
 
 int yaffs_GetObjectFileLength(yaffs_Object *obj)
@@ -7120,7 +7128,7 @@ int yaffs_GetObjectFileLength(yaffs_Object *obj)
        if (obj->variantType == YAFFS_OBJECT_TYPE_SYMLINK){
                if(!obj->variant.symLinkVariant.alias)
                        return 0;
-               return yaffs_strlen(obj->variant.symLinkVariant.alias);
+               return yaffs_strnlen(obj->variant.symLinkVariant.alias,YAFFS_MAX_ALIAS_LENGTH);
        } else {
                /* Only a directory should drop through to here */
                return obj->myDev->nDataBytesPerChunk;