From: Nikolay Borisov <nborisov@suse.com>
Date: Tue, 30 May 2017 14:10:07 +0000 (+0300)
Subject: src/listxattr: Fix reading past the end of the user buffer
X-Git-Tag: v2022.05.01~2027
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=63a912525aabd64b8026bb7bcd02b7a0f504eec4;p=users%2Fhch%2Fxfstests-dev.git

src/listxattr: Fix reading past the end of the user buffer

listxattr reaturns a null-terminated list of entries that represent
the xattr names. However, if it is passed larger buffer than it
requires it won't zero-out the rest of the memory. The way the
loop iterator in listxattr.c is written makes it go print every
null-terminated entry up to bufsize (which is user passed parameter).
This can lead to a situation where listxattr users N bytes out of
M bytes big buffer ( M > N). This will leave the rest (M-N)
as garbage, which in turn will be printed by listxattr. Fix this
by converting the 'for' loop to 'while' and properly ensuring
we are reading at most howevermany elements the syscall reported
it returned

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
---

diff --git a/src/listxattr.c b/src/listxattr.c
index cd46637aa..d8517f56f 100644
--- a/src/listxattr.c
+++ b/src/listxattr.c
@@ -60,10 +60,10 @@ int main(int argc, char **argv)
         if (ret < 0) {
                 perror("listxattr");
         } else {
-                char *l;
-                for (l = buf; l != (buf + bufsize) && *l != '\0';
-                                l = strchr(l, '\0') + 1) {
+                char *l = buf;
+                while (l < (buf + ret)) {
                         printf("xattr: %s\n", l);
+                        l = strchr(l, '\0') + 1;
                 }
         }