diff options
| author | mav <mav@FreeBSD.org> | 2016-10-12 05:15:09 +0000 |
|---|---|---|
| committer | mav <mav@FreeBSD.org> | 2016-10-12 05:15:09 +0000 |
| commit | c63a80428d27ada2807893286912e5c887019c66 (patch) | |
| tree | dcef8b0fedb57f1d5c97ad74633efb10ff830da0 /cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c | |
| parent | 6cff35eca653c8c09f9cb679e7810dfbe6020574 (diff) | |
| download | FreeBSD-src-c63a80428d27ada2807893286912e5c887019c66.zip FreeBSD-src-c63a80428d27ada2807893286912e5c887019c66.tar.gz | |
MFC r305209: MFV r302660: 6314 buffer overflow in dsl_dataset_name
illumos/illumos-gate@9adfa60d484ce2435f5af77cc99dcd4e692b6660
https://github.com/illumos/illumos-gate/commit/9adfa60d484ce2435f5af77cc99dcd4e6
92b6660
https://www.illumos.org/issues/6314
Callers of dsl_dataset_name pass a buffer of size ZFS_MAXNAMELEN, but
dsl_dataset_name copies the datasets' name PLUS the snapshot name to it,
resulting in a max of 2 * ZFS_MAXNAMELEN + '@'.
Reviewed by: George Wilson <george.wilson@delphix.com>
Reviewed by: Prakash Surya <prakash.surya@delphix.com>
Reviewed by: Igor Kozhukhov <ikozhukhov@gmail.com>
Approved by: Dan McDonald <danmcd@omniti.com>
Author: Matthew Ahrens <mahrens@delphix.com>
Diffstat (limited to 'cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c')
| -rw-r--r-- | cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c b/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c index 09289a6..c1ada8d 100644 --- a/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c +++ b/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c @@ -265,7 +265,7 @@ lzc_snapshot(nvlist_t *snaps, nvlist_t *props, nvlist_t **errlist) nvpair_t *elem; nvlist_t *args; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; *errlist = NULL; @@ -317,7 +317,7 @@ lzc_destroy_snaps(nvlist_t *snaps, boolean_t defer, nvlist_t **errlist) nvpair_t *elem; nvlist_t *args; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; /* determine the pool name */ elem = nvlist_next_nvpair(snaps, NULL); @@ -344,7 +344,7 @@ lzc_snaprange_space(const char *firstsnap, const char *lastsnap, nvlist_t *args; nvlist_t *result; int err; - char fs[MAXNAMELEN]; + char fs[ZFS_MAX_DATASET_NAME_LEN]; char *atp; /* determine the fs name */ @@ -409,7 +409,7 @@ lzc_exists(const char *dataset) int lzc_hold(nvlist_t *holds, int cleanup_fd, nvlist_t **errlist) { - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; nvlist_t *args; nvpair_t *elem; int error; @@ -456,7 +456,7 @@ lzc_hold(nvlist_t *holds, int cleanup_fd, nvlist_t **errlist) int lzc_release(nvlist_t *holds, nvlist_t **errlist) { - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; nvpair_t *elem; /* determine the pool name */ @@ -743,7 +743,7 @@ lzc_bookmark(nvlist_t *bookmarks, nvlist_t **errlist) { nvpair_t *elem; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; /* determine the pool name */ elem = nvlist_next_nvpair(bookmarks, NULL); @@ -805,7 +805,7 @@ lzc_destroy_bookmarks(nvlist_t *bmarks, nvlist_t **errlist) { nvpair_t *elem; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; /* determine the pool name */ elem = nvlist_next_nvpair(bmarks, NULL); |
