Print this page
6314 buffer overflow in dsl_dataset_name

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/fs/zfs/dsl_dataset.c
          +++ new/usr/src/uts/common/fs/zfs/dsl_dataset.c
↓ open down ↓ 660 lines elided ↑ open up ↑
 661  661                  dsl_dir_name(ds->ds_dir, name);
 662  662                  VERIFY0(dsl_dataset_get_snapname(ds));
 663  663                  if (ds->ds_snapname[0]) {
 664  664                          (void) strcat(name, "@");
 665  665                          /*
 666  666                           * We use a "recursive" mutex so that we
 667  667                           * can call dprintf_ds() with ds_lock held.
 668  668                           */
 669  669                          if (!MUTEX_HELD(&ds->ds_lock)) {
 670  670                                  mutex_enter(&ds->ds_lock);
      671 +                                VERIFY3U(strlen(name) +
      672 +                                         strlen(ds->ds_snapname) + 1, <=,
      673 +                                         ZFS_MAXNAMELEN);
 671  674                                  (void) strcat(name, ds->ds_snapname);
 672  675                                  mutex_exit(&ds->ds_lock);
 673  676                          } else {
      677 +                                VERIFY3U(strlen(name) +
      678 +                                         strlen(ds->ds_snapname) + 1, <=,
      679 +                                         ZFS_MAXNAMELEN);
 674  680                                  (void) strcat(name, ds->ds_snapname);
 675  681                          }
 676  682                  }
 677  683          }
 678  684  }
 679  685  
 680  686  void
 681  687  dsl_dataset_rele(dsl_dataset_t *ds, void *tag)
 682  688  {
 683  689          dmu_buf_rele(ds->ds_dbuf, tag);
↓ open down ↓ 2824 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX