Sophie

Sophie

distrib > Scientific%20Linux > 5x > x86_64 > by-pkgid > 130701790bf2d95e902edf16031ff596 > files > 46

autofs-5.0.1-0.rc2.164.el5_8.src.rpm

autofs-5.0.1 - fix bad alloca usage

From: Ian Kent <raven@themaw.net>

In the lookup_ghost() function alloca is used within a loop which can
lead to stack overflow.
---

 CHANGELOG       |    1 +
 daemon/lookup.c |    6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)


--- autofs-5.0.1.orig/CHANGELOG
+++ autofs-5.0.1/CHANGELOG
@@ -55,6 +55,7 @@
 - fix nonstrict multi-mount handling.
 - add nobind option.
 - fix not bind mounting local filesystem.
+- fix bad alloca usage.
 
 1/9/2006 autofs-5.0.1 rc2
 -------------------------
--- autofs-5.0.1.orig/daemon/lookup.c
+++ autofs-5.0.1/daemon/lookup.c
@@ -604,7 +604,7 @@ int lookup_ghost(struct autofs_point *ap
 				goto next;
 			}
 
-			fullpath = alloca(strlen(me->key) + strlen(root) + 3);
+			fullpath = malloc(strlen(me->key) + strlen(root) + 3);
 			if (!fullpath) {
 				warn(ap->logopt, "failed to allocate full path");
 				goto next;
@@ -615,6 +615,7 @@ int lookup_ghost(struct autofs_point *ap
 			if (ret == -1 && errno != ENOENT) {
 				char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 				warn(ap->logopt, "stat error %s", estr);
+				free(fullpath);
 				goto next;
 			}
 
@@ -623,6 +624,7 @@ int lookup_ghost(struct autofs_point *ap
 				char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 				warn(ap->logopt,
 				     "mkdir_path %s failed: %s", fullpath, estr);
+				free(fullpath);
 				goto next;
 			}
 
@@ -630,6 +632,8 @@ int lookup_ghost(struct autofs_point *ap
 				me->dev = st.st_dev;
 				me->ino = st.st_ino;
 			}
+
+			free(fullpath);
 next:
 			me = cache_enumerate(mc, me);
 		}