exportfs crash with long path
Subsystems (2)
Hello. I opened a bug with nfs-utils on Redhat Bugzilla. And got an advice to email upstream. So I just repeat my bug text with a patch.
How reproducible:
always
Steps to Reproduce:
# mkdir -p /home/kudinae/Общедоступные # echo '/home/kudinae/Общедоступные oek-1(rw,sync,no_wdelay,no_root_squash,no_subtree_check)' > /etc/exports # exportfs -a Segmentation fault
I've obtained the sources. So a crush happens on export.c:293. variable pos has negative value. I think problem into strtoint and export_hash functions. strtoint has unsigned type and always returns positive value but export_hash impicity cast it to signed int. So it is possible to get negative value. I wrote patch to fix this.
Original Red Hat bug
https://bugzilla.redhat.com/show_bug.cgi?id=863054
support/export/export.c +1 -1
@@ -357,7 +357,7 @@ strtoint(char *str)static int export_hash (char *str) { -int num =strtoint (str); +unsigned int num =strtoint (str);return num %HASH_TABLE_SIZE ; }
Quoted 12 lines · Ivan Romanov
Hello. I opened a bug with nfs-utils on Redhat Bugzilla. And got an advice to email upstream. So I just repeat my bug text with a patch.
How reproducible:
alwaysSteps to Reproduce:
# mkdir -p /home/kudinae/Общедоступные # echo '/home/kudinae/Общедоступные oek-1(rw,sync,no_wdelay,no_root_squash,no_subtree_check)' > /etc/exports # exportfs -a Segmentation fault
Quoted 5 lines
I've obtained the sources. So a crush happens on export.c:293. variable pos has negative value. I think problem into strtoint and
export_hashfunctions. strtoint has unsigned type and always returns positive value butexport_hashimpicity cast it to signed int. So it is possible to get negative value. I wrote patch to fix this.
The fix looks right to me, thanks.--b.
Quoted 17 lines
Original Red Hat bug
https://bugzilla.redhat.com/show_bug.cgi?id=863054support/export/export.c +1
-1@@ -357,7 +357,7 @@ strtoint(char *str)static int export_hash (char *str) { -int num =strtoint (str); +unsigned int num =strtoint (str);return num %HASH_TABLE_SIZE ; }
Quoted 12 lines · Ivan Romanov
Hello. I opened a bug with nfs-utils on Redhat Bugzilla. And got an advice to email upstream. So I just repeat my bug text with a patch.
How reproducible:
alwaysSteps to Reproduce:
# mkdir -p /home/kudinae/Общедоступные # echo '/home/kudinae/Общедоступные oek-1(rw,sync,no_wdelay,no_root_squash,no_subtree_check)' > /etc/exports # exportfs -a Segmentation fault
Quoted 9 lines
I've obtained the sources. So a crush happens on export.c:293. variable pos has negative value. I think problem into strtoint and
export_hashfunctions. strtoint has unsigned type and always returns positive value butexport_hashimpicity cast it to signed int. So it is possible to get negative value. I wrote patch to fix this.Original Red Hat bug
https://bugzilla.redhat.com/show_bug.cgi?id=863054
Committed...
steved.