mount: -a segfaults when 4th field is omitted (mount options)

 # echo 'tmpd /tmp/x tmpfs' >> /etc/fstab
 # mkdir /tmp/x
 # mount -a
 segfault

Reported-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/mount/mount.c b/mount/mount.c
index ba711498d3e0afd11d8ab5c28122bfed5fe181ba..29963c21113f4ebc386170b09eafab9b6ccf6ada 100644 (file)
--- a/mount/mount.c
+++ b/mount/mount.c
@@ -1163,7 +1163,9 @@ is_mounted_same_loopfile(const char *node0, const char *loopfile, unsigned long
                        res = loopfile_used_with((char *) mnt->m.mnt_fsname,
                                        loopfile, offset);
 
-               else if ((p = strstr(mnt->m.mnt_opts, "loop="))) {
+               else if (mnt->m.mnt_opts &&
+                        (p = strstr(mnt->m.mnt_opts, "loop=")))
+               {
                        char *dev = xstrdup(p+5);
                        if ((p = strchr(dev, ',')))
                                *p = '\0';
@@ -2052,8 +2054,8 @@ is_fstab_entry_mounted(struct mntentchn *mc, int verbose)
                goto yes;
 
        /* extra care for loop devices */
-       if ((strstr(mc->m.mnt_opts, "loop=") ||
-            (stat(mc->m.mnt_fsname, &st) == 0 && S_ISREG(st.st_mode)))) {
+       if ((mc->m.mnt_opts && strstr(mc->m.mnt_opts, "loop=")) ||
+           (stat(mc->m.mnt_fsname, &st) == 0 && S_ISREG(st.st_mode))) {
 
                char *p = get_option_value(mc->m.mnt_opts, "offset=");
                uintmax_t offset = 0;

diff --git a/mount/mount_mntent.c b/mount/mount_mntent.c
index d90def36b1851566661eccfbc1be9507680a42d3..f42c0adff220a6e7516cbe22dbc815668ce01ae7 100644 (file)
--- a/mount/mount_mntent.c
+++ b/mount/mount_mntent.c
@@ -70,7 +70,7 @@ my_addmntent (mntFILE *mfp, struct my_mntent *mnt) {
        m1 = mangle(mnt->mnt_fsname);
        m2 = mangle(mnt->mnt_dir);
        m3 = mangle(mnt->mnt_type);
-       m4 = mangle(mnt->mnt_opts);
+       m4 = mnt->mnt_opts ? mangle(mnt->mnt_opts) : "rw";
 
        res = fprintf (mfp->mntent_fp, "%s %s %s %s %d %d\n",
                       m1, m2, m3, m4, mnt->mnt_freq, mnt->mnt_passno);
@@ -78,7 +78,8 @@ my_addmntent (mntFILE *mfp, struct my_mntent *mnt) {
        free(m1);
        free(m2);
        free(m3);
-       free(m4);
+       if (mnt->mnt_opts)
+               free(m4);
        return (res < 0) ? 1 : 0;
 }
 

diff --git a/mount/sundries.c b/mount/sundries.c
index ae4501ac7414604b61815fa5f1534a6d31915693..2dec37f451fbfcb63885987d33d54f4678ff8689 100644 (file)
--- a/mount/sundries.c
+++ b/mount/sundries.c
@@ -217,6 +217,8 @@ matching_opts (const char *options, const char *test_opts) {
 
      if (test_opts == NULL)
          return 1;
+     if (options == NULL)
+         options = "";
 
      len = strlen(test_opts);
      q = alloca(len+1);