diff options
| author | mav <mav@FreeBSD.org> | 2016-10-12 05:43:25 +0000 |
|---|---|---|
| committer | mav <mav@FreeBSD.org> | 2016-10-12 05:43:25 +0000 |
| commit | f3f275d095c2a89024db371ff7dc6e4bfb1a8013 (patch) | |
| tree | 18e8bf0d06fb9b5650896180c34645d11873411e /sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_bookmark.c | |
| parent | 4ed177fc9a714da83875da5c0b7c181756a5821c (diff) | |
| download | FreeBSD-src-f3f275d095c2a89024db371ff7dc6e4bfb1a8013.zip FreeBSD-src-f3f275d095c2a89024db371ff7dc6e4bfb1a8013.tar.gz | |
MFC r305209: MFV r302660: 6314 buffer overflow in dsl_dataset_name
illumos/illumos-gate@9adfa60d484ce2435f5af77cc99dcd4e692b6660
https://github.com/illumos/illumos-gate/commit/9adfa60d484ce2435f5af77cc99dcd4e6
92b6660
https://www.illumos.org/issues/6314
Callers of dsl_dataset_name pass a buffer of size ZFS_MAXNAMELEN, but
dsl_dataset_name copies the datasets' name PLUS the snapshot name to it,
resulting in a max of 2 * ZFS_MAXNAMELEN + '@'.
Reviewed by: George Wilson <george.wilson@delphix.com>
Reviewed by: Prakash Surya <prakash.surya@delphix.com>
Reviewed by: Igor Kozhukhov <ikozhukhov@gmail.com>
Approved by: Dan McDonald <danmcd@omniti.com>
Author: Matthew Ahrens <mahrens@delphix.com>
Diffstat (limited to 'sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_bookmark.c')
| -rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_bookmark.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_bookmark.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_bookmark.c index bc08d1c..39d572c 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_bookmark.c +++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_bookmark.c @@ -34,10 +34,10 @@ static int dsl_bookmark_hold_ds(dsl_pool_t *dp, const char *fullname, dsl_dataset_t **dsp, void *tag, char **shortnamep) { - char buf[MAXNAMELEN]; + char buf[ZFS_MAX_DATASET_NAME_LEN]; char *hashp; - if (strlen(fullname) >= MAXNAMELEN) + if (strlen(fullname) >= ZFS_MAX_DATASET_NAME_LEN) return (SET_ERROR(ENAMETOOLONG)); hashp = strchr(fullname, '#'); if (hashp == NULL) |
