diff options
| author | mav <mav@FreeBSD.org> | 2016-10-12 05:43:25 +0000 |
|---|---|---|
| committer | mav <mav@FreeBSD.org> | 2016-10-12 05:43:25 +0000 |
| commit | f3f275d095c2a89024db371ff7dc6e4bfb1a8013 (patch) | |
| tree | 18e8bf0d06fb9b5650896180c34645d11873411e /sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c | |
| parent | 4ed177fc9a714da83875da5c0b7c181756a5821c (diff) | |
| download | FreeBSD-src-f3f275d095c2a89024db371ff7dc6e4bfb1a8013.zip FreeBSD-src-f3f275d095c2a89024db371ff7dc6e4bfb1a8013.tar.gz | |
MFC r305209: MFV r302660: 6314 buffer overflow in dsl_dataset_name
illumos/illumos-gate@9adfa60d484ce2435f5af77cc99dcd4e692b6660
https://github.com/illumos/illumos-gate/commit/9adfa60d484ce2435f5af77cc99dcd4e6
92b6660
https://www.illumos.org/issues/6314
Callers of dsl_dataset_name pass a buffer of size ZFS_MAXNAMELEN, but
dsl_dataset_name copies the datasets' name PLUS the snapshot name to it,
resulting in a max of 2 * ZFS_MAXNAMELEN + '@'.
Reviewed by: George Wilson <george.wilson@delphix.com>
Reviewed by: Prakash Surya <prakash.surya@delphix.com>
Reviewed by: Igor Kozhukhov <ikozhukhov@gmail.com>
Approved by: Dan McDonald <danmcd@omniti.com>
Author: Matthew Ahrens <mahrens@delphix.com>
Diffstat (limited to 'sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c')
| -rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c index 25a7d96..f57a511 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c +++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c @@ -20,7 +20,7 @@ */ /* * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. - * Copyright (c) 2012, 2014 by Delphix. All rights reserved. + * Copyright (c) 2012, 2015 by Delphix. All rights reserved. * Copyright 2015, Joyent, Inc. */ @@ -1059,7 +1059,7 @@ dsl_prop_get_all_ds(dsl_dataset_t *ds, nvlist_t **nvp, dsl_pool_t *dp = dd->dd_pool; objset_t *mos = dp->dp_meta_objset; int err = 0; - char setpoint[MAXNAMELEN]; + char setpoint[ZFS_MAX_DATASET_NAME_LEN]; VERIFY(nvlist_alloc(nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0); |
