autofs-5.1.7 - add buffer length check to rmdir_path() From: Ian Kent Add a length check before copying the incoming path string to the work buffer. Signed-off-by: Ian Kent --- CHANGELOG | 1 + daemon/automount.c | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index ded0f00f..38304720 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -86,6 +86,7 @@ - add mapent path length check in handle_packet_expire_direct(). - add copy length check in umount_autofs_indirect(). - add some buffer length checks to master map parser. +- add buffer length check to rmdir_path(). 25/01/2021 autofs-5.1.7 - make bind mounts propagation slave by default. diff --git a/daemon/automount.c b/daemon/automount.c index 45e0833f..114b013a 100644 --- a/daemon/automount.c +++ b/daemon/automount.c @@ -241,15 +241,19 @@ int mkdir_path(const char *path, mode_t mode) int rmdir_path(struct autofs_point *ap, const char *path, dev_t dev) { int len = strlen(path); - char buf[PATH_MAX]; + char buf[PATH_MAX + 1]; char *cp; int first = 1; struct stat st; struct statfs fs; + if (len > PATH_MAX) { + error(ap->logopt, "path longer than maximum length"); + return -1; + } strcpy(buf, path); - cp = buf + len; + cp = buf + len; do { *cp = '\0';