Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1255634?usp=email ) Change subject: recovery_fs: Fix stack buffer overflow, underflow, and NUL termination ...................................................................... recovery_fs: Fix stack buffer overflow, underflow, and NUL termination 1. In fs_add_revoke_fh(), when new_pathpos >= sizeof(path), LogCrit() logged that the path was too long without returning, falling through into memcpy() and overflowing char path[PATH_MAX] on the stack. Also guard the NAME_MAX directory segment loop against exceeding PATH_MAX. 2. In fs_reclaim_complete(), path[dstpos] = '/' overwrites the NUL terminator written by fs_make_path(), and memcpy(..., marker_len) copied reclaim_complete_marker without its terminating NUL byte into an uninitialized stack buffer before calling creat(path, 0700). Copy marker_len + 1 bytes so path is NUL-terminated. 3. In fs_make_path(), propagate negative error returns from fs_make_ip_recov_dir_name() before indexing path[dstpos] = '\0'. GitHub Issue: #1423 Change-Id: I8efffe84ff2f89f4ecd66ed6750a2094924d1fab Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/SAL/recovery/recovery_fs.c 1 file changed, 11 insertions(+), 2 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/34/1255634/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1255634?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I8efffe84ff2f89f4ecd66ed6750a2094924d1fab Gerrit-Change-Number: 1255634 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>