diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2013-09-06 22:55:36 +0200 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2013-09-08 01:54:55 +0200 |
| commit | dfc59e2c90f780653e7b0b749c2a547a9bb1b2ce (patch) | |
| tree | 79f0b0f0867348e16390e58e2e5282722dedf372 | |
| parent | afs: get rid of redundant ->d_name.len checks (diff) | |
| download | linux-dfc59e2c90f780653e7b0b749c2a547a9bb1b2ce.tar.xz linux-dfc59e2c90f780653e7b0b749c2a547a9bb1b2ce.zip | |
exportfs: don't assume that ->iterate() won't feed us too long entries
On some filesystems it's impossible even with fs corruption, but we'd
better not rely on that, what with memcpy() into on-stack array we
are doing there.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | fs/exportfs/expfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c index 293bc2e47a73..a235f0016889 100644 --- a/fs/exportfs/expfs.c +++ b/fs/exportfs/expfs.c @@ -231,7 +231,7 @@ static int filldir_one(void * __buf, const char * name, int len, int result = 0; buf->sequence++; - if (buf->ino == ino) { + if (buf->ino == ino && len <= NAME_MAX) { memcpy(buf->name, name, len); buf->name[len] = '\0'; buf->found = 1; |