linux-nfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Jeff Layton <jlayton@poochiereds.net>
To: steved@redhat.com
Cc: linux-nfs@vger.kernel.org, Jeff Law <law@redhat.com>,
	Jakub Jelinek <jakub@redhat.com>
Subject: [PATCH] mountd: fix segfault in add_name with newer gcc compilers
Date: Wed, 30 Apr 2014 15:39:19 -0400	[thread overview]
Message-ID: <1398886759-29090-1-git-send-email-jlayton@poochiereds.net> (raw)

I hit a segfault in add_name with a mountd built with gcc-4.9.0. Some
NULL pointer checks got reordered such that a pointer was dereferenced
before checking to see whether it was NULL. The problem was due to
nfs-utils relying on undefined behavior, which tricked gcc into assuming
that the pointer would never be NULL.

At first I assumed that this was a compiler bug, but Jakub Jelinek and
Jeff Law pointed out:

"If old is NULL, then:

	strncpy(new, old, cp-old);

is undefined behavior (even when cp == old == NULL in that case),
therefore gcc assumes that old is never NULL, as otherwise it would be
invalid.

Just guard
	strncpy(new, old, cp-old);
	new[cp-old] = 0;
with if (old) { ... }."

This patch does that. If old is NULL though, then we still need to
ensure that new is NULL terminated, lest the subsequent strcats walk off
the end of it.

Cc: Jeff Law <law@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Signed-off-by: Jeff Layton <jlayton@poochiereds.net>
---
 support/export/client.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/support/export/client.c b/support/export/client.c
index dbf47b966522..f85e11c8b535 100644
--- a/support/export/client.c
+++ b/support/export/client.c
@@ -482,8 +482,12 @@ add_name(char *old, const char *add)
 		else
 			cp = cp + strlen(cp);
 	}
-	strncpy(new, old, cp-old);
-	new[cp-old] = 0;
+	if (old) {
+		strncpy(new, old, cp-old);
+		new[cp-old] = 0;
+	} else {
+		new[0] = 0;
+	}
 	if (cp != old && !*cp)
 		strcat(new, ",");
 	strcat(new, add);
-- 
1.9.0


             reply	other threads:[~2014-04-30 19:39 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-04-30 19:39 Jeff Layton [this message]
2014-05-01 15:17 ` [PATCH] mountd: fix segfault in add_name with newer gcc compilers Steve Dickson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1398886759-29090-1-git-send-email-jlayton@poochiereds.net \
    --to=jlayton@poochiereds.net \
    --cc=jakub@redhat.com \
    --cc=law@redhat.com \
    --cc=linux-nfs@vger.kernel.org \
    --cc=steved@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).