Commit 9a7532e5 authored by Wayne Davison's avatar Wayne Davison

Fix directory-length overflow bug (7057).

parent 9b594a53
...@@ -1728,21 +1728,29 @@ static void send_directory(int f, struct file_list *flist, char *fbuf, int len, ...@@ -1728,21 +1728,29 @@ static void send_directory(int f, struct file_list *flist, char *fbuf, int len,
} }
p = fbuf + len; p = fbuf + len;
if (len != 1 || *fbuf != '/') if (len == 1 && *fbuf == '/')
remainder = MAXPATHLEN - 1;
else if (len < MAXPATHLEN-1) {
*p++ = '/'; *p++ = '/';
*p = '\0'; *p = '\0';
remainder = MAXPATHLEN - (p - fbuf); remainder = MAXPATHLEN - (len + 1);
} else
remainder = 0;
for (errno = 0, di = readdir(d); di; errno = 0, di = readdir(d)) { for (errno = 0, di = readdir(d); di; errno = 0, di = readdir(d)) {
char *dname = d_name(di); char *dname = d_name(di);
if (dname[0] == '.' && (dname[1] == '\0' if (dname[0] == '.' && (dname[1] == '\0'
|| (dname[1] == '.' && dname[2] == '\0'))) || (dname[1] == '.' && dname[2] == '\0')))
continue; continue;
if (strlcpy(p, dname, remainder) >= remainder) { unsigned name_len = strlcpy(p, dname, remainder);
if (name_len >= remainder) {
char save = fbuf[len];
fbuf[len] = '\0';
io_error |= IOERR_GENERAL; io_error |= IOERR_GENERAL;
rprintf(FERROR_XFER, rprintf(FERROR_XFER,
"cannot send long-named file %s\n", "filename overflows max-path len by %u: %s/%s\n",
full_fname(fbuf)); name_len - remainder + 1, fbuf, dname);
fbuf[len] = save;
continue; continue;
} }
if (dname[0] == '\0') { if (dname[0] == '\0') {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment