DF-3246 / df3246.c
/* DF-3246: isofncmp signed-int overflow in ';version' parse lets * lookup("NAME;4294967297") match an image entry "NAME;1" (i wraps mod 2^32). */ #include <stdio.h> #include <string.h> #include <errno.h> #include <fcntl.h> #include <unistd.h> #include <sys/stat.h> int main(int argc, char **argv) { /* argv[1] = mountpoint, argv[2] = basename stored as NAME;1 */ char path[1024], base[256]; snprintf(base, sizeof(base), "%s", argv[2]); /* strip any existing ;N */ char *semi = strchr(base, ';'); if (semi) *semi = 0; snprintf(path, sizeof(path), "%s/%s;1", argv[1], base); struct stat st; printf("stat(%s) -> ", path); fflush(stdout); if (stat(path, &st) == 0) printf("OK\n"); else printf("FAIL (%s)\n", strerror(errno)); snprintf(path, sizeof(path), "%s/%s;4294967297", argv[1], base); printf("stat(%s) -> ", path); fflush(stdout); if (stat(path, &st) == 0) { printf("OK <-- BUG: matched NAME;1 via int wrap\n"); return 2; } printf("FAIL (%s)\n", strerror(errno)); return 0; } |