diff mbox series

[pseudo,v2] pseudo_client: Fix xattr/rename handling with empty paths

Message ID 20261015220227.794655-1-richard.purdie@linuxfoundation.org
State New
Headers show
Series [pseudo,v2] pseudo_client: Fix xattr/rename handling with empty paths | expand

Commit Message

Richard Purdie Oct. 15, 2026, 10:02 p.m. UTC 
On Fedora45, we can end up in a situation where path_extra_1 (for xattr/rename ops)
but path is of zero length. The path_extra_1 codepath does not handle this well and
corrupts memory.

The issue is "partial_len = pathlen - 1 - strip_slash" when pathlen is 0 (and
hence strip_slash is also 0). This leads to invalid memory writes and if those
happen to access off the end of a mapped segment, the program segfaults.

Fix the code to handle the pathlen=0 case.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 pseudo_client.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)
diff mbox series

Patch

diff --git a/pseudo_client.c b/pseudo_client.c
index d83175e..1c742ba 100644
--- a/pseudo_client.c
+++ b/pseudo_client.c
@@ -1791,7 +1791,11 @@  pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
 	 */
 	if (path_extra_1) {
 		size_t full_len = path_extra_1len + 1 + pathlen - strip_slash;
-		size_t partial_len = pathlen - 1 - strip_slash;
+		size_t partial_len = pathlen - strip_slash;
+		if (!pathlen) {
+			full_len += 1;
+			partial_len = 1;
+		}
 		if (path_extra_2) {
 			full_len += path_extra_2len + 1;
 		}
@@ -1806,12 +1810,14 @@  pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
 				return 0;
 			}
 		}
-		memcpy(alloced_path, path, partial_len);
-		alloced_path[partial_len] = '\0';
-		memcpy(alloced_path + partial_len + 1, path_extra_1, path_extra_1len);
-		alloced_path[partial_len + path_extra_1len + 1] = '\0';
+		if (pathlen) {
+			memcpy(alloced_path, path, partial_len - 1);
+		{
+		alloced_path[partial_len - 1] = '\0';
+		memcpy(alloced_path + partial_len, path_extra_1, path_extra_1len);
+		alloced_path[partial_len + path_extra_1len] = '\0';
 		if (path_extra_2) {
-			memcpy(alloced_path + partial_len + path_extra_1len + 2, path_extra_2, path_extra_2len);
+			memcpy(alloced_path + partial_len + path_extra_1len + 1, path_extra_2, path_extra_2len);
 		}
 		alloced_path[full_len - 1] = '\0';
 		path = alloced_path;