diff options
| author | mav <mav@FreeBSD.org> | 2016-10-12 05:43:25 +0000 |
|---|---|---|
| committer | mav <mav@FreeBSD.org> | 2016-10-12 05:43:25 +0000 |
| commit | f3f275d095c2a89024db371ff7dc6e4bfb1a8013 (patch) | |
| tree | 18e8bf0d06fb9b5650896180c34645d11873411e /sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_userhold.c | |
| parent | 4ed177fc9a714da83875da5c0b7c181756a5821c (diff) | |
| download | FreeBSD-src-f3f275d095c2a89024db371ff7dc6e4bfb1a8013.zip FreeBSD-src-f3f275d095c2a89024db371ff7dc6e4bfb1a8013.tar.gz | |
MFC r305209: MFV r302660: 6314 buffer overflow in dsl_dataset_name
illumos/illumos-gate@9adfa60d484ce2435f5af77cc99dcd4e692b6660
https://github.com/illumos/illumos-gate/commit/9adfa60d484ce2435f5af77cc99dcd4e6
92b6660
https://www.illumos.org/issues/6314
Callers of dsl_dataset_name pass a buffer of size ZFS_MAXNAMELEN, but
dsl_dataset_name copies the datasets' name PLUS the snapshot name to it,
resulting in a max of 2 * ZFS_MAXNAMELEN + '@'.
Reviewed by: George Wilson <george.wilson@delphix.com>
Reviewed by: Prakash Surya <prakash.surya@delphix.com>
Reviewed by: Igor Kozhukhov <ikozhukhov@gmail.com>
Approved by: Dan McDonald <danmcd@omniti.com>
Author: Matthew Ahrens <mahrens@delphix.com>
Diffstat (limited to 'sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_userhold.c')
| -rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_userhold.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_userhold.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_userhold.c index a67db5f..54a15e1 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_userhold.c +++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_userhold.c @@ -20,7 +20,7 @@ */ /* * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. - * Copyright (c) 2012, 2014 by Delphix. All rights reserved. + * Copyright (c) 2012, 2015 by Delphix. All rights reserved. * Copyright (c) 2013 Steven Hartland. All rights reserved. */ @@ -180,7 +180,7 @@ dsl_dataset_user_hold_sync_one_impl(nvlist_t *tmpholds, dsl_dataset_t *ds, } typedef struct zfs_hold_cleanup_arg { - char zhca_spaname[MAXNAMELEN]; + char zhca_spaname[ZFS_MAX_DATASET_NAME_LEN]; uint64_t zhca_spa_load_guid; nvlist_t *zhca_holds; } zfs_hold_cleanup_arg_t; @@ -574,7 +574,7 @@ dsl_dataset_user_release_impl(nvlist_t *holds, nvlist_t *errlist, error = dsl_dataset_hold_obj_string(tmpdp, nvpair_name(pair), FTAG, &ds); if (error == 0) { - char name[MAXNAMELEN]; + char name[ZFS_MAX_DATASET_NAME_LEN]; dsl_dataset_name(ds, name); dsl_pool_config_exit(tmpdp, FTAG); dsl_dataset_rele(ds, FTAG); |
