]> git.ipfire.org Git - thirdparty/xfsprogs-dev.git/commit
xfs_db: fix crash when field list selector string has trailing slash
authorDarrick J. Wong <darrick.wong@oracle.com>
Thu, 4 Jan 2018 19:58:29 +0000 (13:58 -0600)
committerEric Sandeen <sandeen@redhat.com>
Thu, 4 Jan 2018 19:58:29 +0000 (13:58 -0600)
commit945e47e2fcc5d1cec693122286da06d8ab829c52
tree0f40e9d099c6425fdaa6a2c51c817b1946f44cce
parentb638281fee0bf4edc6328629eddc60e47bef153c
xfs_db: fix crash when field list selector string has trailing slash

If I run the following command:

xfs_db /dev/sdf -x -c 'agf 0' -c 'addr refcntroot' -c 'addr ptrs[1]\'

it errors out with "bad character in field \" and
then ftok_free crashes on an invalid free() because picking up the
previous token (the closing bracket) xrealloc'd the token array to be 5
elements long but never set the last element's tok pointer.
Consequently the ftok_free tries to free whatever garbage pointer is in
that last element and kaboom.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@sandeen.net>
[sandeen: slightly clarify commit log]
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
db/flist.c