autofs-5.1.7 - add length check in umount_subtree_mounts() From: Ian Kent Coverity: fixed_size_dest: You might overrun the 4097-character fixed-size string "key" by copying "me->key" without checking the length. Signed-off-by: Ian Kent --- CHANGELOG | 1 + daemon/automount.c | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index 224f58d6..9e385ba9 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -55,6 +55,7 @@ - fix possible memory leak in master_parse(). - fix possible memory leak in mnts_add_amdmount(). - fix double unlock in parse_mount(). +- add length check in umount_subtree_mounts(). 25/01/2021 autofs-5.1.7 - make bind mounts propagation slave by default. diff --git a/daemon/automount.c b/daemon/automount.c index 48472d5f..70506d83 100644 --- a/daemon/automount.c +++ b/daemon/automount.c @@ -562,6 +562,11 @@ static int umount_subtree_mounts(struct autofs_point *ap, const char *path, unsi left++; } + if (me->len > PATH_MAX) { + crit(ap->logopt, "me->key too long for buffer"); + return 1; + } + strcpy(key, me->key); cache_unlock(mc);