[PATCH] Sanity checks for brackets (escaped or otherwise) in server name

[PATCH] Sanity checks for brackets (escaped or otherwise) in server name

[Siddhesh Poyarekar]

When autofs is configured as follows:

* -nodev,nosuid,intr,soft,retry=10,proto=tcp &:/tmp1

One could make a mount request as follows:

df /autom/tmp1/som\(efile

and crash automount, since automount tries to parse the brackets to
get the weight for the server. Automount should not parse these
brackets if they're escaped.

Also throw a syntax error in case of mismatched brackets instead of
crashing. Sample configuration for this:

* -nodev,nosuid,intr,soft,retry=10,proto=tcp foo(2:/tmp1

Signed-off-by: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>
---
 modules/replicated.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/modules/replicated.c b/modules/replicated.c
index 975c254..248da54 100644
--- a/modules/replicated.c
+++ b/modules/replicated.c
@@ -1206,7 +1206,7 @@ static char *seek_delim(const char *s)
 	char *delim;
 
 	delim = strpbrk(p, "(, \t:");
-	if (delim && *delim != ':')
+	if (delim && *delim != ':' && (delim == s || *(delim - 1) != '\\'))
 		return delim;
 
 	while (*p) {
@@ -1255,6 +1255,12 @@ int parse_location(unsigned logopt, struct host **hosts,
 					*delim = '\0';
 					weight = atoi(w);
 				}
+				else {
+					/* syntax error - Mismatched brackets */
+					free_host_list(hosts);
+					free(str);
+					return 0;
+				}
 				delim++;
 			}
 
-- 
1.7.4

Re: [PATCH] Sanity checks for brackets (escaped or otherwise) in server name

[Ian Kent]

On Fri, 2011-04-01 at 14:43 +0530, Siddhesh Poyarekar wrote:
> When autofs is configured as follows:
> 
> * -nodev,nosuid,intr,soft,retry=10,proto=tcp &:/tmp1
> 
> One could make a mount request as follows:
> 
> df /autom/tmp1/som\(efile
> 
> and crash automount, since automount tries to parse the brackets to
> get the weight for the server. Automount should not parse these
> brackets if they're escaped.
> 
> Also throw a syntax error in case of mismatched brackets instead of
> crashing. Sample configuration for this:
> 
> * -nodev,nosuid,intr,soft,retry=10,proto=tcp foo(2:/tmp1
> 
> Signed-off-by: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>

Thanks for being through, but it's already in the commit queue, due to
the RHEL and Fedora bugs you logged. The patch remains attributed to
you, of course.

Can't say when the bunch of patches I have in the queue will be
committed and posted. Also, I've still got a couple of must fix bugs
before I roll them up into the next release and I'm also quite busy.

Ian