]>
Commit | Line | Data |
---|---|---|
74cc6069 | 1 | diff -Nurp autofs-4.1.4.orig/lib/cache.c autofs-4.1.4/lib/cache.c |
2 | --- autofs-4.1.4.orig/lib/cache.c 2005-02-06 14:00:53.000000000 +0800 | |
3 | +++ autofs-4.1.4/lib/cache.c 2005-05-07 17:29:21.000000000 +0800 | |
4 | @@ -337,8 +337,10 @@ void cache_clean(const char *root, time_ | |
5 | if (!path) | |
6 | return; | |
7 | ||
8 | - if (is_mounted(_PATH_MOUNTED, path)) | |
9 | + if (is_mounted(_PATH_MOUNTED, path)) { | |
10 | + free(path); | |
11 | continue; | |
12 | + } | |
13 | ||
14 | if (me->age < age) { | |
15 | mapent_hash[i] = me->next; | |
16 | diff -Nurp autofs-4.1.4.orig/modules/lookup_file.c autofs-4.1.4/modules/lookup_file.c | |
17 | --- autofs-4.1.4.orig/modules/lookup_file.c 2005-04-06 23:14:23.000000000 +0800 | |
18 | +++ autofs-4.1.4/modules/lookup_file.c 2005-05-07 17:27:30.000000000 +0800 | |
19 | @@ -157,6 +157,10 @@ static int read_one(FILE *f, char *key, | |
20 | break; | |
21 | ||
22 | case st_compare: | |
23 | + if (kptr - key > KEY_MAX_LEN) { | |
24 | + state = st_badent; | |
25 | + break; | |
26 | + } | |
27 | if (ch == '\n') | |
28 | state = st_begin; | |
29 | else if (isspace(ch) && !escape) { | |
30 | diff -Nurp autofs-4.1.4.orig/modules/parse_sun.c autofs-4.1.4/modules/parse_sun.c | |
31 | --- autofs-4.1.4.orig/modules/parse_sun.c 2005-05-07 17:39:44.000000000 +0800 | |
32 | +++ autofs-4.1.4/modules/parse_sun.c 2005-05-07 17:35:27.000000000 +0800 | |
33 | @@ -680,6 +680,10 @@ static int sun_mount(const char *root, c | |
34 | "mounting root %s, mountpoint %s, what %s, fstype %s, options %s\n", | |
35 | root, mountpoint, what, fstype, options); | |
36 | ||
37 | + /* A malformed entry of the form key /xyz will trigger this case */ | |
38 | + if (!what || *what == '\0') | |
39 | + return 1; | |
40 | + | |
41 | if (!strcmp(fstype, "nfs")) { | |
42 | rv = mount_nfs->mount_mount(root, mountpoint, strlen(mountpoint), | |
43 | what, fstype, options, mount_nfs->context); | |
44 | @@ -695,6 +699,18 @@ static int sun_mount(const char *root, c | |
45 | return rv; | |
46 | } | |
47 | ||
48 | +static int key_exists(struct multi_mnt *list, char *path, int pathlen) | |
49 | +{ | |
50 | + struct multi_mnt *mmptr = list; | |
51 | + | |
52 | + while (mmptr && pathlen == strlen(mmptr->path)) { | |
53 | + if (!strncmp(mmptr->path, path, pathlen)) | |
54 | + return 1; | |
55 | + mmptr = mmptr->next; | |
56 | + } | |
57 | + return 0; | |
58 | +} | |
59 | + | |
60 | /* | |
61 | * Build list of mounts in shortest -> longest order. | |
62 | * Pass in list head and return list head. | |
63 | @@ -725,6 +741,12 @@ struct multi_mnt *multi_add_list(struct | |
64 | mmptr = mmptr->next; | |
65 | } | |
66 | ||
67 | + /* if a multimount entry has duplicate keys, it is invalid */ | |
68 | + if (key_exists(mmptr, path, plen)) { | |
69 | + free(new); | |
70 | + return NULL; | |
71 | + } | |
72 | + | |
73 | if (old) | |
74 | old->next = new; | |
75 | new->next = mmptr; |