autofs-5.0.4-fix-map-type-info-parse-error-update.patch

   1 autofs-5.0.4 - fix map type info parse error update
   2
   3 From: Ian Kent <raven@themaw.net>
   4
   5 Make parsing map type info more robust.
   6 ---
   7
   8  lib/parse_subs.c |  123 +++++++++++++++++++++++++++++++++++++++++++++---------
   9  1 files changed, 102 insertions(+), 21 deletions(-)
  10
  11
  12 diff --git a/lib/parse_subs.c b/lib/parse_subs.c
  13 index 0608cb7..2326838 100644
  14 --- a/lib/parse_subs.c
  15 +++ b/lib/parse_subs.c
  16 @@ -20,6 +20,30 @@
  17  #include <ctype.h>
  18  #include "automount.h"
  19
  20 +struct types {
  21 +       char *type;
  22 +       unsigned int len;
  23 +};
  24 +
  25 +static struct types map_type[] = {
  26 +       { "file", 4 },
  27 +       { "program", 7 },
  28 +       { "yp", 2 },
  29 +       { "nis", 3 },
  30 +       { "nisplus", 7 },
  31 +       { "ldap", 4 },
  32 +       { "ldaps", 5 },
  33 +       { "hesiod", 6 },
  34 +       { "userdir", 7 },
  35 +};
  36 +static unsigned int map_type_count = sizeof(map_type)/sizeof(struct types);
  37 +
  38 +static struct types format_type[] = {
  39 +       { "sun", 3 },
  40 +       { "hesiod", 6 },
  41 +};
  42 +static unsigned int format_type_count = sizeof(format_type)/sizeof(struct types);
  43 +
  44  /*
  45   * Skip whitespace in a string; if we hit a #, consider the rest of the
  46   * entry a comment.
  47 @@ -315,7 +339,7 @@ struct map_type_info *parse_map_type_info(const char *str)
  48  {
  49         struct map_type_info *info;
  50         char *buf, *type, *fmt, *map, *tmp;
  51 -       int seen_colon = 0;
  52 +       char *pos;
  53
  54         buf = strdup(str);
  55         if (!buf)
  56 @@ -328,32 +352,89 @@ struct map_type_info *parse_map_type_info(const char *str)
  57         }
  58         memset(info, 0, sizeof(struct map_type_info));
  59
  60 -       type = fmt = NULL;
  61 +       type = fmt = map = NULL;
  62 +
  63 +       tmp = strchr(buf, ':');
  64 +       if (!tmp) {
  65 +               pos = buf;
  66 +               while (*pos == ' ')
  67 +                       *pos++ = '\0';
  68 +               map = pos;
  69 +       } else {
  70 +               int i, j;
  71 +
  72 +               for (i = 0; i < map_type_count; i++) {
  73 +                       char *m_type = map_type[i].type;
  74 +                       unsigned int m_len = map_type[i].len;
  75 +
  76 +                       pos = buf;
  77 +
  78 +                       if (strncmp(m_type, pos, m_len))
  79 +                               continue;
  80 +
  81 +                       type = pos;
  82 +                       pos += m_len;
  83 +
  84 +                       if (*pos == ' ' || *pos == ':') {
  85 +                               while (*pos == ' ')
  86 +                                       *pos++ = '\0';
  87 +                               if (*pos != ':') {
  88 +                                       free(buf);
  89 +                                       free(info);
  90 +                                       return NULL;
  91 +                               } else {
  92 +                                       *pos++ = '\0';
  93 +                                       while (*pos == ' ')
  94 +                                               *pos++ = '\0';
  95 +                                       map = pos;
  96 +                                       break;
  97 +                               }
  98 +                       }
  99 +
 100 +                       if (*pos == ',') {
 101 +                               *pos++ = '\0';
 102 +                               for (j = 0; j < format_type_count; j++) {
 103 +                                       char *f_type = format_type[j].type;
 104 +                                       unsigned int f_len = format_type[j].len;
 105 +
 106 +                                       if (strncmp(f_type, pos, f_len))
 107 +                                               continue;
 108 +
 109 +                                       fmt = pos;
 110 +                                       pos += f_len;
 111 +
 112 +                                       if (*pos == ' ' || *pos == ':') {
 113 +                                               while (*pos == ' ')
 114 +                                                       *pos++ = '\0';
 115 +                                               if (*pos != ':') {
 116 +                                                       free(buf);
 117 +                                                       free(info);
 118 +                                                       return NULL;
 119 +                                               } else {
 120 +                                                       *pos++ = '\0';
 121 +                                                       while (*pos == ' ')
 122 +                                                               *pos++ = '\0';
 123 +                                                       map = pos;
 124 +                                                       break;
 125 +                                               }
 126 +                                       }
 127 +                               }
 128 +                       }
 129 +               }
 130 +
 131 +               if (!type) {
 132 +                       pos = buf;
 133 +                       while (*pos == ' ')
 134 +                               *pos++ = '\0';
 135 +                       map = pos;
 136 +               }
 137 +       }
 138
 139         /* Look for space terminator - ignore local options */
 140 -       map = buf;
 141         for (tmp = buf; *tmp; tmp++) {
 142                 if (*tmp == ' ') {
 143                         *tmp = '\0';
 144                         break;
 145 -               } else if (!seen_colon && *tmp == ',') {
 146 -                       type = buf;
 147 -                       *tmp++ = '\0';
 148 -                       fmt = tmp;
 149 -               } else if (*tmp == ':') {
 150 -                       seen_colon = 1;
 151 -                       if (!fmt)
 152 -                               type = buf;
 153 -                       *tmp++ = '\0';
 154 -                       map = tmp;
 155 -               } else if (*tmp == '[') {
 156 -                       /*
 157 -                        * Unescaped '[' is a syntax error here as only
 158 -                        * an ldap map with a type specified should contain
 159 -                        * them.
 160 -                        */
 161 -                       free(buf);
 162 -                       return 0;
 163                 }
 164                 if (*tmp == '\\')
 165                         tmp++;