From: charles Date: Mon, 7 Dec 2009 01:17:33 +0000 (+0000) Subject: Change to strnlen() and strncpy() to avoid problems from unbounded strings X-Git-Tag: pre-name-change~161 X-Git-Url: http://www.aleph1.co.uk/gitweb/?p=yaffs2.git;a=commitdiff_plain;h=ea3c314412ed2ecee3f47b576d5759267173e9c0 Change to strnlen() and strncpy() to avoid problems from unbounded strings --- diff --git a/direct/yaffsfs.c b/direct/yaffsfs.c index f0e1f45..bb6f5f6 100644 --- a/direct/yaffsfs.c +++ b/direct/yaffsfs.c @@ -24,7 +24,7 @@ #endif -const char *yaffsfs_c_version="$Id: yaffsfs.c,v 1.28 2009-10-19 23:42:55 charles Exp $"; +const char *yaffsfs_c_version="$Id: yaffsfs.c,v 1.29 2009-12-07 01:17:33 charles Exp $"; // configurationList is the list of devices that are supported static yaffsfs_DeviceConfiguration *yaffsfs_configurationList; @@ -1544,7 +1544,7 @@ struct yaffs_dirent *yaffs_readdir(yaffs_DIR *dirp) dsc->de.d_dont_use = (unsigned)dsc->nextReturn; dsc->de.d_off = dsc->offset++; yaffs_GetObjectName(dsc->nextReturn,dsc->de.d_name,NAME_MAX); - if(yaffs_strlen(dsc->de.d_name) == 0) + if(yaffs_strnlen(dsc->de.d_name,NAME_MAX+1) == 0) { // this should not happen! yaffs_strcpy(dsc->de.d_name,_Y("zz")); @@ -1652,6 +1652,7 @@ int yaffs_link(const YCHAR *oldpath, const YCHAR *newpath) yaffs_Object *obj = NULL; yaffs_Object *target = NULL; int retVal = 0; + int newNameLength = 0; yaffsfs_Lock(); @@ -1680,8 +1681,18 @@ int yaffs_link(const YCHAR *oldpath, const YCHAR *newpath) yaffsfs_SetError(-EXDEV); retVal = -1; } - - if(newdir && yaffs_strlen(newname) > 0) { + + newNameLength = yaffs_strnlen(newname,YAFFS_MAX_NAME_LENGTH+1); + + if(newNameLength == 0){ + yaffsfs_SetError(-ENOENT); + retVal = -1; + } else if (newNameLength > YAFFS_MAX_NAME_LENGTH){ + yaffsfs_SetError(-ENAMETOOLONG); + retVal = -1; + } + + if(retVal == 0) { link = yaffs_Link(newdir,newname,obj); if(link) retVal = 0; diff --git a/direct/yaffsfs.h b/direct/yaffsfs.h index 7cb8453..8a7cb81 100644 --- a/direct/yaffsfs.h +++ b/direct/yaffsfs.h @@ -114,6 +114,10 @@ #define ENOTEMPTY 39 #endif +#ifndef ENAMETOOLONG +#define ENAMETOOLONG 36 +#endif + #ifndef ENOMEM #define ENOMEM 12 #endif diff --git a/direct/ydirectenv.h b/direct/ydirectenv.h index 3c009a4..68c99db 100644 --- a/direct/ydirectenv.h +++ b/direct/ydirectenv.h @@ -41,7 +41,7 @@ #define yaffs_strcpy(a,b) strcpy(a,b) #define yaffs_strncpy(a,b,c) strncpy(a,b,c) #define yaffs_strncmp(a,b,c) strncmp(a,b,c) -#define yaffs_strlen(s) strlen(s) +#define yaffs_strnlen(s,m) strnlen(s,m) #define yaffs_sprintf sprintf #define yaffs_toupper(a) toupper(a) diff --git a/yaffs_guts.c b/yaffs_guts.c index 9f6ba51..a51d82d 100644 --- a/yaffs_guts.c +++ b/yaffs_guts.c @@ -12,7 +12,7 @@ */ const char *yaffs_guts_c_version = - "$Id: yaffs_guts.c,v 1.97 2009-12-06 22:53:10 charles Exp $"; + "$Id: yaffs_guts.c,v 1.98 2009-12-07 01:17:33 charles Exp $"; #include "yportenv.h" @@ -1130,7 +1130,7 @@ static void yaffs_SetObjectName(yaffs_Object *obj, const YCHAR *name) { #ifdef CONFIG_YAFFS_SHORT_NAMES_IN_RAM memset(obj->shortName, 0, sizeof(YCHAR) * (YAFFS_SHORT_NAME_LENGTH+1)); - if (name && yaffs_strlen(name) <= YAFFS_SHORT_NAME_LENGTH) + if (name && yaffs_strnlen(name,YAFFS_SHORT_NAME_LENGTH+1) <= YAFFS_SHORT_NAME_LENGTH) yaffs_strcpy(obj->shortName, name); else obj->shortName[0] = _Y('\0'); @@ -2257,14 +2257,17 @@ static yaffs_Object *yaffs_FindOrCreateObjectByNumber(yaffs_Device *dev, static YCHAR *yaffs_CloneString(const YCHAR *str) { YCHAR *newStr = NULL; + int len; if (!str) str = _Y(""); - newStr = YMALLOC((yaffs_strlen(str) + 1) * sizeof(YCHAR)); - if (newStr) - yaffs_strcpy(newStr, str); - + len = yaffs_strnlen(str,YAFFS_MAX_ALIAS_LENGTH); + newStr = YMALLOC((len + 1) * sizeof(YCHAR)); + if (newStr){ + yaffs_strncpy(newStr, str,len); + newStr[len] = 0; + } return newStr; } @@ -2499,7 +2502,7 @@ int yaffs_RenameObject(yaffs_Object *oldDir, const YCHAR *oldName, force = 1; #endif - if(yaffs_strlen(newName) > YAFFS_MAX_NAME_LENGTH) + if(yaffs_strnlen(newName,YAFFS_MAX_NAME_LENGTH+1) > YAFFS_MAX_NAME_LENGTH) /* ENAMETOOLONG */ return YAFFS_FAIL; @@ -5107,7 +5110,7 @@ loff_t yaffs_GetFileSize(yaffs_Object *obj) alias = obj->variant.symLinkVariant.alias; if(!alias) return 0; - return yaffs_strlen(alias); + return yaffs_strnlen(alias,YAFFS_MAX_ALIAS_LENGTH); default: return 0; } @@ -7091,7 +7094,7 @@ int yaffs_GetObjectName(yaffs_Object *obj, YCHAR *name, int buffSize) } #ifdef CONFIG_YAFFS_SHORT_NAMES_IN_RAM else if (obj->shortName[0]) - yaffs_strcpy(name, obj->shortName); + yaffs_strncpy(name, obj->shortName,YAFFS_SHORT_NAME_LENGTH+1); #endif else { int result; @@ -7107,11 +7110,12 @@ int yaffs_GetObjectName(yaffs_Object *obj, YCHAR *name, int buffSize) NULL); } yaffs_strncpy(name, oh->name, buffSize - 1); + name[buffSize-1]=0; yaffs_ReleaseTempBuffer(obj->myDev, buffer, __LINE__); } - return yaffs_strlen(name); + return yaffs_strnlen(name,buffSize-1); } int yaffs_GetObjectFileLength(yaffs_Object *obj) @@ -7124,7 +7128,7 @@ int yaffs_GetObjectFileLength(yaffs_Object *obj) if (obj->variantType == YAFFS_OBJECT_TYPE_SYMLINK){ if(!obj->variant.symLinkVariant.alias) return 0; - return yaffs_strlen(obj->variant.symLinkVariant.alias); + return yaffs_strnlen(obj->variant.symLinkVariant.alias,YAFFS_MAX_ALIAS_LENGTH); } else { /* Only a directory should drop through to here */ return obj->myDev->nDataBytesPerChunk; diff --git a/yportenv.h b/yportenv.h index dd8c561..1967cb1 100644 --- a/yportenv.h +++ b/yportenv.h @@ -55,7 +55,7 @@ #define yaffs_strcpy(a, b) strcpy(a, b) #define yaffs_strncpy(a, b, c) strncpy(a, b, c) #define yaffs_strncmp(a, b, c) strncmp(a, b, c) -#define yaffs_strlen(s) strlen(s) +#define yaffs_strnlen(s,m) strnlen(s,m) #define yaffs_sprintf sprintf #define yaffs_toupper(a) toupper(a) @@ -129,7 +129,7 @@ #define yaffs_strcat(a, b) strcat(a, b) #define yaffs_strcpy(a, b) strcpy(a, b) #define yaffs_strncpy(a, b, c) strncpy(a, b, c) -#define yaffs_strlen(s) strlen(s) +#define yaffs_strnlen(s,m) strnlen(s,m) #define yaffs_sprintf sprintf #define yaffs_toupper(a) toupper(a)