Opened 10 years ago

Closed 10 years ago

#5008 closed bug (invalid)

readdir_r crashes

Reported by: MrSunshine Owned by: axeld
Priority: high Milestone: R1
Component: System/libroot.so Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Has a Patch: no Platform: x86

Description

using this test on my computer readdir_r crashes for me and outputs jibberish. Might be me doing something wrong tho but cant figure out what =)

#include <sys/types.h> 
#include <dirent.h> 
#include <errno.h> 
#include <stdio.h> 
 
main() { 
  DIR *dir = opendir("/boot/home"); 
  struct dirent *d; 
  struct dirent d_mem; 
  int ret; 
  while ((ret = readdir_r(dir, &d_mem, &d)) == 0) { 
    printf("%s %d\n", d->d_name, ret); 
  } 
  closedir(dir); 
} 

output:
~> ./a.out
. 0
..H@r 0
.bHhist 0
Kill Thread
~>

actual content:
~> ls -la
total 86
drwxr-xr-x 1 user root 2048 Nov 20 12:53 .
drwxr-xr-x 1 user root 2048 Nov 17 00:49 ..
-rw------- 1 user root 1936 Nov 20 11:23 .bash_history
drwxr-xr-x 1 user root 2048 Nov 17 10:25 .config
-rw------- 1 user root 77 Nov 20 11:56 .cvspass
-rw------- 1 user root 11884 Nov 20 12:53 .viminfo
drwxr-xr-x 1 user root 2048 Nov 18 17:38 Desktop
-rwxr-xr-x 1 user root 5443 Nov 20 11:49 a.out
drwxr-xr-x 1 user root 2048 Nov 17 00:51 config
drwxr-xr-x 1 user root 2048 Nov 17 00:54 mail
drwxr-xr-x 1 user root 2048 Nov 18 08:38 queries
-rwxr-xr-x 1 user root 5632 Nov 17 20:54 test
-rw-r--r-- 1 user root 1187 Nov 20 11:19 test.c
-rw-r--r-- 1 user root 310 Nov 20 11:49 test2.c

Change History (1)

comment:1 Changed 10 years ago by axeld

Resolution: invalid
Status: newclosed

Quoting http://www.opengroup.org/onlinepubs/9699919799/functions/readdir.html "The storage pointed to by entry shall be large enough for a dirent with an array of char d_name members containing at least {NAME_MAX}+1 elements."

Your dirent buffer is too small.

Note: See TracTickets for help on using tickets.