diff options
| author | delphij <delphij@FreeBSD.org> | 2007-11-12 18:57:33 +0000 |
|---|---|---|
| committer | delphij <delphij@FreeBSD.org> | 2007-11-12 18:57:33 +0000 |
| commit | 99be157da9aa6ea18f0e5e59136ad72c1b140643 (patch) | |
| tree | 854b7dedfd1d89e2beec7b43c3e0a4b6be7c3da9 /sys/fs/tmpfs/tmpfs_vfsops.c | |
| parent | 117b1bfb947a0ace2d8a87ce362996ed73f6e932 (diff) | |
| download | FreeBSD-src-99be157da9aa6ea18f0e5e59136ad72c1b140643.zip FreeBSD-src-99be157da9aa6ea18f0e5e59136ad72c1b140643.tar.gz | |
Correct a stack overflow which will trigger panics when
mode= is specified, caused by incorrect format string
specified to vfs_scanopt() and subsequently vsscanf().
Pointed out by: kib
Submitted by: des
Diffstat (limited to 'sys/fs/tmpfs/tmpfs_vfsops.c')
| -rw-r--r-- | sys/fs/tmpfs/tmpfs_vfsops.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/fs/tmpfs/tmpfs_vfsops.c b/sys/fs/tmpfs/tmpfs_vfsops.c index 8adcf7a..111d313 100644 --- a/sys/fs/tmpfs/tmpfs_vfsops.c +++ b/sys/fs/tmpfs/tmpfs_vfsops.c @@ -231,7 +231,7 @@ tmpfs_mount(struct mount *mp, struct thread *td) vfs_scanopt(mp->mnt_optnew, "uid", "%d", &root_uid) != 1) root_uid = va.va_uid; if (mp->mnt_cred->cr_ruid != 0 || - vfs_scanopt(mp->mnt_optnew, "mode", "%o", &root_mode) != 1) + vfs_scanopt(mp->mnt_optnew, "mode", "%ho", &root_mode) != 1) root_mode = va.va_mode; if(vfs_scanopt(mp->mnt_optnew, "inodes", "%d", &nodes_max) != 1) nodes_max = 0; |
