diff options
| author | Darrick J. Wong <darrick.wong@oracle.com> | 2018-01-04 13:58:29 -0600 |
|---|---|---|
| committer | Eric Sandeen <sandeen@redhat.com> | 2018-01-04 13:58:29 -0600 |
| commit | 945e47e2fcc5d1cec693122286da06d8ab829c52 (patch) | |
| tree | 0f40e9d099c6425fdaa6a2c51c817b1946f44cce | |
| parent | b638281fee0bf4edc6328629eddc60e47bef153c (diff) | |
| download | xfsprogs-dev-945e47e2fcc5d1cec693122286da06d8ab829c52.tar.gz | |
xfs_db: fix crash when field list selector string has trailing slash
If I run the following command:
xfs_db /dev/sdf -x -c 'agf 0' -c 'addr refcntroot' -c 'addr ptrs[1]\'
it errors out with "bad character in field \" and
then ftok_free crashes on an invalid free() because picking up the
previous token (the closing bracket) xrealloc'd the token array to be 5
elements long but never set the last element's tok pointer.
Consequently the ftok_free tries to free whatever garbage pointer is in
that last element and kaboom.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@sandeen.net>
[sandeen: slightly clarify commit log]
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
| -rw-r--r-- | db/flist.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/db/flist.c b/db/flist.c index e11acbfcb1..b207354a55 100644 --- a/db/flist.c +++ b/db/flist.c @@ -400,6 +400,7 @@ flist_split( strncpy(a, s, l); a[l] = '\0'; v = xrealloc(v, (nv + 2) * sizeof(*v)); + v[nv + 1].tok = NULL; v[nv].tok = a; v[nv].tokty = t; nv++; |