Blame SOURCES/xfsprogs-4.15.0-xfs_db-fix-crash-when-field-list-selector-string-has.patch

e59f31
From 945e47e2fcc5d1cec693122286da06d8ab829c52 Mon Sep 17 00:00:00 2001
e59f31
From: "Darrick J. Wong" <darrick.wong@oracle.com>
e59f31
Date: Thu, 4 Jan 2018 13:58:29 -0600
e59f31
Subject: [PATCH] xfs_db: fix crash when field list selector string has
e59f31
 trailing slash
e59f31
e59f31
If I run the following command:
e59f31
e59f31
xfs_db /dev/sdf -x -c 'agf 0' -c 'addr refcntroot' -c 'addr ptrs[1]\'
e59f31
e59f31
it errors out with "bad character in field \" and
e59f31
then ftok_free crashes on an invalid free() because picking up the
e59f31
previous token (the closing bracket) xrealloc'd the token array to be 5
e59f31
elements long but never set the last element's tok pointer.
e59f31
Consequently the ftok_free tries to free whatever garbage pointer is in
e59f31
that last element and kaboom.
e59f31
e59f31
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
e59f31
Reviewed-by: Eric Sandeen <sandeen@sandeen.net>
e59f31
[sandeen: slightly clarify commit log]
e59f31
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
e59f31
---
e59f31
 db/flist.c | 1 +
e59f31
 1 file changed, 1 insertion(+)
e59f31
e59f31
Index: xfsprogs-4.5.0/db/flist.c
e59f31
===================================================================
e59f31
--- xfsprogs-4.5.0.orig/db/flist.c
e59f31
+++ xfsprogs-4.5.0/db/flist.c
e59f31
@@ -400,6 +400,7 @@ flist_split(
e59f31
 		strncpy(a, s, l);
e59f31
 		a[l] = '\0';
e59f31
 		v = xrealloc(v, (nv + 2) * sizeof(*v));
e59f31
+		v[nv + 1].tok = NULL;
e59f31
 		v[nv].tok = a;
e59f31
 		v[nv].tokty = t;
e59f31
 		nv++;