Skip to contentSkip to conversation

exportfs crash with long path

PATCH Ivan Romanov 3 participants 3 messages Oct 8, 2012 – Oct 15, 2012

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

Hello. I opened a bug with nfs-utils on Redhat Bugzilla. And got an advice to email upstream. So I just repeat my bug text with a patch.

How reproducible:
always

Steps to Reproduce:

# mkdir -p /home/kudinae/Общедоступные
# echo '/home/kudinae/Общедоступные oek-1(rw,sync,no_wdelay,no_root_squash,no_subtree_check)' > /etc/exports
# exportfs -a
Segmentation fault

I've obtained the sources. So a crush happens on export.c:293. variable pos has negative value. I think problem into strtoint and export_hash functions. strtoint has unsigned type and always returns positive value but export_hash impicity cast it to signed int. So it is possible to get negative value. I wrote patch to fix this.

Original Red Hat bug
https://bugzilla.redhat.com/show_bug.cgi?id=863054

support/export/export.c +1 -1
index 4fda30a..0257903 100644
@@ -357,7 +357,7 @@ strtoint(char *str)
 static int 
 export_hash(char *str)
 {
-	int num = strtoint(str);
+	unsigned int num = strtoint(str);
 
 	return num % HASH_TABLE_SIZE;
 }
#1 lore raw
Quoted 12 lines · Ivan Romanov

Hello. I opened a bug with nfs-utils on Redhat Bugzilla. And got an advice to email upstream. So I just repeat my bug text with a patch.

How reproducible:
always

Steps to Reproduce:

# mkdir -p /home/kudinae/Общедоступные
# echo '/home/kudinae/Общедоступные oek-1(rw,sync,no_wdelay,no_root_squash,no_subtree_check)' > /etc/exports
# exportfs -a
Segmentation fault
Quoted 5 lines

I've obtained the sources. So a crush happens on export.c:293. variable pos has negative value. I think problem into strtoint and export_hash functions. strtoint has unsigned type and always returns positive value but export_hash impicity cast it to signed int. So it is possible to get negative value. I wrote patch to fix this.

The fix looks right to me, thanks.--b.

Quoted 17 lines

Original Red Hat bug
https://bugzilla.redhat.com/show_bug.cgi?id=863054

support/export/export.c +1 -1
index 4fda30a..0257903 100644
@@ -357,7 +357,7 @@ strtoint(char *str)
 static int 
 export_hash(char *str)
 {
-	int num = strtoint(str);
+	unsigned int num = strtoint(str);
 
 	return num % HASH_TABLE_SIZE;
 }
#2 lore raw
In reply to Ivan Romanov
Quoted 12 lines · Ivan Romanov

Hello. I opened a bug with nfs-utils on Redhat Bugzilla. And got an advice to email upstream. So I just repeat my bug text with a patch.

How reproducible:
always

Steps to Reproduce:

# mkdir -p /home/kudinae/Общедоступные
# echo '/home/kudinae/Общедоступные oek-1(rw,sync,no_wdelay,no_root_squash,no_subtree_check)' > /etc/exports
# exportfs -a
Segmentation fault
Quoted 9 lines

I've obtained the sources. So a crush happens on export.c:293. variable pos has negative value. I think problem into strtoint and export_hash functions. strtoint has unsigned type and always returns positive value but export_hash impicity cast it to signed int. So it is possible to get negative value. I wrote patch to fix this.

Original Red Hat bug
https://bugzilla.redhat.com/show_bug.cgi?id=863054

Committed...

steved.