From c63a80428d27ada2807893286912e5c887019c66 Mon Sep 17 00:00:00 2001 From: mav Date: Wed, 12 Oct 2016 05:15:09 +0000 Subject: MFC r305209: MFV r302660: 6314 buffer overflow in dsl_dataset_name illumos/illumos-gate@9adfa60d484ce2435f5af77cc99dcd4e692b6660 https://github.com/illumos/illumos-gate/commit/9adfa60d484ce2435f5af77cc99dcd4e6 92b6660 https://www.illumos.org/issues/6314 Callers of dsl_dataset_name pass a buffer of size ZFS_MAXNAMELEN, but dsl_dataset_name copies the datasets' name PLUS the snapshot name to it, resulting in a max of 2 * ZFS_MAXNAMELEN + '@'. Reviewed by: George Wilson Reviewed by: Prakash Surya Reviewed by: Igor Kozhukhov Approved by: Dan McDonald Author: Matthew Ahrens --- .../opensolaris/lib/libzfs_core/common/libzfs_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c') diff --git a/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c b/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c index 09289a6..c1ada8d 100644 --- a/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c +++ b/cddl/contrib/opensolaris/lib/libzfs_core/common/libzfs_core.c @@ -265,7 +265,7 @@ lzc_snapshot(nvlist_t *snaps, nvlist_t *props, nvlist_t **errlist) nvpair_t *elem; nvlist_t *args; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; *errlist = NULL; @@ -317,7 +317,7 @@ lzc_destroy_snaps(nvlist_t *snaps, boolean_t defer, nvlist_t **errlist) nvpair_t *elem; nvlist_t *args; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; /* determine the pool name */ elem = nvlist_next_nvpair(snaps, NULL); @@ -344,7 +344,7 @@ lzc_snaprange_space(const char *firstsnap, const char *lastsnap, nvlist_t *args; nvlist_t *result; int err; - char fs[MAXNAMELEN]; + char fs[ZFS_MAX_DATASET_NAME_LEN]; char *atp; /* determine the fs name */ @@ -409,7 +409,7 @@ lzc_exists(const char *dataset) int lzc_hold(nvlist_t *holds, int cleanup_fd, nvlist_t **errlist) { - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; nvlist_t *args; nvpair_t *elem; int error; @@ -456,7 +456,7 @@ lzc_hold(nvlist_t *holds, int cleanup_fd, nvlist_t **errlist) int lzc_release(nvlist_t *holds, nvlist_t **errlist) { - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; nvpair_t *elem; /* determine the pool name */ @@ -743,7 +743,7 @@ lzc_bookmark(nvlist_t *bookmarks, nvlist_t **errlist) { nvpair_t *elem; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; /* determine the pool name */ elem = nvlist_next_nvpair(bookmarks, NULL); @@ -805,7 +805,7 @@ lzc_destroy_bookmarks(nvlist_t *bmarks, nvlist_t **errlist) { nvpair_t *elem; int error; - char pool[MAXNAMELEN]; + char pool[ZFS_MAX_DATASET_NAME_LEN]; /* determine the pool name */ elem = nvlist_next_nvpair(bmarks, NULL); -- cgit v1.1