diff options
author | Xiaoming Ni <nixiaoming@huawei.com> | 2020-11-26 13:35:10 -0300 |
---|---|---|
committer | Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2020-11-26 17:35:58 -0300 |
commit | 106ff08526d3ca574ba86d891450ea55aa929712 (patch) | |
tree | bdf0f8a9fee37a63ce497ccdce712711023f7a61 /io/ftw.c | |
parent | db07fae8250401adb2b97ab3e53d41da2a6bd767 (diff) | |
download | glibc-106ff08526d3ca574ba86d891450ea55aa929712.zip glibc-106ff08526d3ca574ba86d891450ea55aa929712.tar.gz glibc-106ff08526d3ca574ba86d891450ea55aa929712.tar.bz2 |
io: nftw/ftw: Fix stack overflow with large nopenfd [BZ #26353]
The nopenfd value is used as argument for the internal buffer on
ftw_statup, which is allocated with alloca and might trigger
a stack overflow for large values. This patch replaces the memory
allocation to use malloc instead.
Checked on x86_64-linux-gnu.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Diffstat (limited to 'io/ftw.c')
-rw-r--r-- | io/ftw.c | 16 |
1 files changed, 9 insertions, 7 deletions
@@ -646,15 +646,17 @@ ftw_startup (const char *dir, int is_nftw, void *func, int descriptors, data.maxdir = descriptors < 1 ? 1 : descriptors; data.actdir = 0; - data.dirstreams = (struct dir_data **) alloca (data.maxdir - * sizeof (struct dir_data *)); - memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data *)); - /* PATH_MAX is always defined when we get here. */ data.dirbufsize = MAX (2 * strlen (dir), PATH_MAX); - data.dirbuf = (char *) malloc (data.dirbufsize); - if (data.dirbuf == NULL) + data.dirstreams = malloc (data.maxdir * sizeof (struct dir_data *) + + data.dirbufsize); + if (data.dirstreams == NULL) return -1; + + memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data *)); + + data.dirbuf = (char *) data.dirstreams + + data.maxdir * sizeof (struct dir_data *); cp = __stpcpy (data.dirbuf, dir); /* Strip trailing slashes. */ while (cp > data.dirbuf + 1 && cp[-1] == '/') @@ -803,7 +805,7 @@ ftw_startup (const char *dir, int is_nftw, void *func, int descriptors, out_fail: save_err = errno; __tdestroy (data.known_objects, free); - free (data.dirbuf); + free (data.dirstreams); __set_errno (save_err); return result; |