Jim Chen has uploaded this change for review.

View Change

recovery_fs: Fix stack buffer overflow, underflow, and NUL termination

1. In fs_add_revoke_fh(), when new_pathpos >= sizeof(path), LogCrit()
   logged that the path was too long without returning, falling through
   into memcpy() and overflowing char path[PATH_MAX] on the stack. Also
   guard the NAME_MAX directory segment loop against exceeding PATH_MAX.
2. In fs_reclaim_complete(), path[dstpos] = '/' overwrites the NUL
   terminator written by fs_make_path(), and memcpy(..., marker_len)
   copied reclaim_complete_marker without its terminating NUL byte into
   an uninitialized stack buffer before calling creat(path, 0700).
   Copy marker_len + 1 bytes so path is NUL-terminated.
3. In fs_make_path(), propagate negative error returns from
   fs_make_ip_recov_dir_name() before indexing path[dstpos] = '\0'.

GitHub Issue: #1423

Change-Id: I8efffe84ff2f89f4ecd66ed6750a2094924d1fab
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/SAL/recovery/recovery_fs.c
1 file changed, 11 insertions(+), 2 deletions(-)

git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/34/1255634/1

To view, visit change 1255634. To unsubscribe, or for help writing mail filters, visit settings.