Ticket #3124: d_reclen.diff

src/system/kernel/fs/vfs.cpp

@@ -5461 +5461 @@
 fix_dirent(struct vnode *parent, struct dirent *userEntry,
     struct io_context* ioContext, uint32* _length)
 {
+#define lnd do { ktrace_printf("fix_dirent: %d\n", __LINE__); } while(0)
+    static int callCount = 0;
+    callCount++;
     char buffer[sizeof(struct dirent) + B_FILE_NAME_LENGTH];
     struct dirent* entry;
 
+    bzero(&buffer, sizeof(buffer));
+
     if (IS_USER_ADDRESS(userEntry)) {
+        lnd;
         entry = (struct dirent*)buffer;
         if (user_memcpy(entry, userEntry, sizeof(struct dirent) - 1) != B_OK)
             return B_BAD_ADDRESS;
 
         ASSERT(entry->d_reclen >= sizeof(struct dirent));
 
+        if ( entry->d_reclen > sizeof(buffer))
+        {
+            panic("%d = entry->d_reclen > sizeof(buffer) = %d", entry->d_reclen, (unsigned)sizeof(buffer));
+            return B_BAD_VALUE;
+        }
+
         if (user_memcpy(entry->d_name, userEntry->d_name,
                 entry->d_reclen - sizeof(struct dirent)) != B_OK)
             return B_BAD_ADDRESS;
     } else
         entry = userEntry;
 
+    ktrace_printf("fix_dirent(%d): _length=%p, entry=%p, parent=%p, entry->d_name=%s\n",
+            callCount, _length, entry,parent, entry->d_name);
     *_length = entry->d_reclen;
+    lnd;
 
     // set d_pdev and d_pino
     entry->d_pdev = parent->device;
+    lnd;
     entry->d_pino = parent->id;
+    lnd;
 
     // If this is the ".." entry and the directory is the root of a FS,
     // we need to replace d_dev and d_ino with the actual values.
@@ -5529 +5546 @@
         return user_memcpy(userEntry, entry, sizeof(struct dirent) - 1);
 
     return B_OK;
+#undef lnd
 }
 
 
@@ -5536 +5554 @@
 dir_read(struct io_context* ioContext, struct vnode *vnode, void *cookie,
     struct dirent *buffer, size_t bufferSize, uint32 *_count)
 {
+    static int callCount=0;
+    callCount ++;
     if (!HAS_FS_CALL(vnode, read_dir))
         return EOPNOTSUPP;
 
@@ -5549 +5569 @@
     if (count > 0) {
         for (uint32 i = 0; i < count; i++) {
             uint32 length;
+            ktrace_printf("dir_read(%d): cookie=%p, _count=%p, count=%d, i=%d, bufferSize=%d\n",
+                    callCount, cookie, _count, (unsigned)count, (unsigned)i, (unsigned)bufferSize);
+            ktrace_printf("fix_dirent args: parent=%p, userEntry=%p, ioContext=%p, _length=%p\n",
+                    vnode, buffer, ioContext, &length);
             error = fix_dirent(vnode, buffer, ioContext, &length);
             if (error != B_OK)
                 return error;