ash: expand: Fix buffer overflow in expandmeta
authorDenys Vlasenko <vda.linux@googlemail.com>
Sat, 14 Apr 2018 12:50:47 +0000 (14:50 +0200)
committerDenys Vlasenko <vda.linux@googlemail.com>
Sat, 14 Apr 2018 12:50:47 +0000 (14:50 +0200)
commitd5f5045b43bd7a55402dfcecde511a2c207d07b7
tree9e57ed30cf4918a5e205b964ce7dd5d15b295590
parent0dd3be8c0933d5649152b6019b975876e804e22a
ash: expand: Fix buffer overflow in expandmeta

Upstream commit:

    Date: Sun, 25 Mar 2018 16:38:00 +0800
    expand: Fix buffer overflow in expandmeta

    The native version of expandmeta allocates a buffer that may be
    overrun for two reasons.  First of all the size is 1 byte too small
    but this is normally hidden because the minimum size is rounded
    up to 2048 bytes.  Secondly, if the directory level is deep enough,
    any buffer can be overrun.

    This patch fixes both problems by calling realloc when necessary.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
function                                             old     new   delta
expmeta                                              517     635    +118
expandarg                                            990     996      +6
mklocal                                              288     290      +2
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/0 up/down: 126/0)             Total: 126 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
shell/ash.c