43 lines
1.1 KiB
Diff
43 lines
1.1 KiB
Diff
autofs-5.1.7 - add length check in umount_subtree_mounts()
|
|
|
|
From: Ian Kent <raven@themaw.net>
|
|
|
|
Coverity: fixed_size_dest: You might overrun the 4097-character
|
|
fixed-size string "key" by copying "me->key" without
|
|
checking the length.
|
|
|
|
Signed-off-by: Ian Kent <raven@themaw.net>
|
|
---
|
|
CHANGELOG | 1 +
|
|
daemon/automount.c | 5 +++++
|
|
2 files changed, 6 insertions(+)
|
|
|
|
diff --git a/CHANGELOG b/CHANGELOG
|
|
index 224f58d6..9e385ba9 100644
|
|
--- a/CHANGELOG
|
|
+++ b/CHANGELOG
|
|
@@ -55,6 +55,7 @@
|
|
- fix possible memory leak in master_parse().
|
|
- fix possible memory leak in mnts_add_amdmount().
|
|
- fix double unlock in parse_mount().
|
|
+- add length check in umount_subtree_mounts().
|
|
|
|
25/01/2021 autofs-5.1.7
|
|
- make bind mounts propagation slave by default.
|
|
diff --git a/daemon/automount.c b/daemon/automount.c
|
|
index 48472d5f..70506d83 100644
|
|
--- a/daemon/automount.c
|
|
+++ b/daemon/automount.c
|
|
@@ -562,6 +562,11 @@ static int umount_subtree_mounts(struct autofs_point *ap, const char *path, unsi
|
|
left++;
|
|
}
|
|
|
|
+ if (me->len > PATH_MAX) {
|
|
+ crit(ap->logopt, "me->key too long for buffer");
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
strcpy(key, me->key);
|
|
|
|
cache_unlock(mc);
|