15 May, 2008
1 commit
-
match_strcpy() is a somewhat creepy function: the caller needs to make sure
that the destination buffer is big enough, and when he screws up or
forgets, match_strcpy() happily overruns the buffer.There's exactly one customer: v9fs_parse_options(). I believe it currently
can't overflow its buffer, but that's not exactly obvious.The source string is a substing of the mount options. The kernel silently
truncates those to PAGE_SIZE bytes, including the terminating zero. See
compat_sys_mount() and do_mount().The destination buffer is obtained from __getname(), which allocates from
name_cachep, which is initialized by vfs_caches_init() for size PATH_MAX.We're safe as long as PATH_MAX
Cc: Latchesar Ionkov
Cc: Jim Meyering
Cc: "Randy.Dunlap"
Signed-off-by: Andrew Morton
Signed-off-by: Eric Van Hensbergen
03 May, 2007
1 commit
-
Make the match_*() functions take a const pointer to the options table
and make strings pointers in the options table const too.Signed-off-by: David Howells
Signed-off-by: David S. Miller
17 Apr, 2005
1 commit
-
Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.Let it rip!
