diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2008-09-01 09:38:32 -0400 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2008-09-01 09:38:32 -0400 |
| commit | 7fd2651f67a43fad3cc1cc2db7c0e5f9c568023c (patch) | |
| tree | 781483c927690b61866d6b6f4ade6a8b8c7f5e47 /lib/e2p | |
| parent | f6d179f5d304ed2ece6abf6addfb6a2cf402f192 (diff) | |
| download | e2fsprogs-7fd2651f67a43fad3cc1cc2db7c0e5f9c568023c.tar.gz | |
libe2p: Fix potential core-dumping bug in iterate_on_dir()
iterate_on_dir() can try to copy too much data from the directory
entry, resulting in a crash.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Diffstat (limited to 'lib/e2p')
| -rw-r--r-- | lib/e2p/iod.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/e2p/iod.c b/lib/e2p/iod.c index 2c675b9d..1edfc4f2 100644 --- a/lib/e2p/iod.c +++ b/lib/e2p/iod.c @@ -56,12 +56,12 @@ int iterate_on_dir (const char * dir_name, return -1; } while ((dep = readdir (dir))) { - len = sizeof(struct dirent); #ifdef HAVE_RECLEN_DIRENT - if (len < dep->d_reclen) - len = dep->d_reclen; + len = dep->d_reclen; if (len > max_len) len = max_len; +#else + len = sizeof(struct dirent); #endif memcpy(de, dep, len); if ((*func)(dir_name, de, private)) |