libmount: more robust options string parsing

 # mount -o=rw /dev/sdb /mnt/test
 mount: libmount/src/optmap.c:212: mnt_optmap_get_entry: Assertion `namelen' failed.
 Aborted (core dumped)

Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=968786
Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/libmount/src/optstr.c b/libmount/src/optstr.c
index 5e9e708074955118442a2b4403e389d967fd9db2..3c680ff6e76ce4dcf40c159fbe9e265d4568a822 100644 (file)
--- a/libmount/src/optstr.c
+++ b/libmount/src/optstr.c
@@ -77,7 +77,7 @@ static int mnt_optstr_parse_next(char **optstr,        char **name, size_t *namesz,
                        open_quote ^= 1;        /* reverse the status */
                if (open_quote)
                        continue;               /* still in quoted block */
-               if (!sep && *p == '=')
+               if (!sep && p > start && *p == '=')
                        sep = p;                /* name and value separator */
                if (*p == ',')
                        stop = p;               /* terminate the option item */
@@ -540,7 +540,7 @@ int mnt_split_optstr(const char *optstr, char **user, char **vfs,
        if (user)
                *user = NULL;
 
-       while(!mnt_optstr_next_option(&str, &name, &namesz, &val, &valsz)) {
+       while (!mnt_optstr_next_option(&str, &name, &namesz, &val, &valsz)) {
                int rc = 0;
                const struct libmnt_optmap *ent = NULL;
                const struct libmnt_optmap *m =

diff --git a/sys-utils/mount.c b/sys-utils/mount.c
index 8ff94611c600cd591b853e09883f63026fe0e476..0998b011021212265e50500ab020c7c25baec4fa 100644 (file)
--- a/sys-utils/mount.c
+++ b/sys-utils/mount.c
@@ -682,6 +682,8 @@ static void sanitize_paths(struct libmnt_context *cxt)
 
 static void append_option(struct libmnt_context *cxt, const char *opt)
 {
+       if (opt && (*opt == '=' || *opt == '\'' || *opt == '\"' || isblank(*opt)))
+               errx(MOUNT_EX_USAGE, _("unsupported option format: %s"), opt);
        if (mnt_context_append_options(cxt, opt))
                err(MOUNT_EX_SYSERR, _("failed to append option '%s'"), opt);
 }