diff options
| author | Igor Kozhukhov <[email protected]> | 2016-06-15 14:28:36 -0700 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2016-06-28 13:47:03 -0700 |
| commit | eca7b76001a7d33f78bd98884aef8325bdbf98e7 (patch) | |
| tree | bdcd0489c5a6c7840258c4c6063c9a4903bec256 /module/zfs/dmu_objset.c | |
| parent | 43e52eddb13d8accbd052fac9a242ce979531aa4 (diff) | |
OpenZFS 6314 - buffer overflow in dsl_dataset_name
Reviewed by: George Wilson <[email protected]>
Reviewed by: Prakash Surya <[email protected]>
Reviewed by: Igor Kozhukhov <[email protected]>
Approved by: Dan McDonald <[email protected]>
Ported-by: Brian Behlendorf <[email protected]>
OpenZFS-issue: https://www.illumos.org/issues/6314
OpenZFS-commit: https://github.com/openzfs/openzfs/commit/d6160ee
Diffstat (limited to 'module/zfs/dmu_objset.c')
| -rw-r--r-- | module/zfs/dmu_objset.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/module/zfs/dmu_objset.c b/module/zfs/dmu_objset.c index a9991aabb..22ca84d96 100644 --- a/module/zfs/dmu_objset.c +++ b/module/zfs/dmu_objset.c @@ -671,7 +671,7 @@ dmu_objset_refresh_ownership(objset_t *os, void *tag) { dsl_pool_t *dp; dsl_dataset_t *ds, *newds; - char name[MAXNAMELEN]; + char name[ZFS_MAX_DATASET_NAME_LEN]; ds = os->os_dsl_dataset; VERIFY3P(ds, !=, NULL); @@ -895,6 +895,9 @@ dmu_objset_create_check(void *arg, dmu_tx_t *tx) if (strchr(doca->doca_name, '@') != NULL) return (SET_ERROR(EINVAL)); + if (strlen(doca->doca_name) >= ZFS_MAX_DATASET_NAME_LEN) + return (SET_ERROR(ENAMETOOLONG)); + error = dsl_dir_hold(dp, doca->doca_name, FTAG, &pdd, &tail); if (error != 0) return (error); @@ -981,6 +984,9 @@ dmu_objset_clone_check(void *arg, dmu_tx_t *tx) if (strchr(doca->doca_clone, '@') != NULL) return (SET_ERROR(EINVAL)); + if (strlen(doca->doca_clone) >= ZFS_MAX_DATASET_NAME_LEN) + return (SET_ERROR(ENAMETOOLONG)); + error = dsl_dir_hold(dp, doca->doca_clone, FTAG, &pdd, &tail); if (error != 0) return (error); @@ -1020,7 +1026,7 @@ dmu_objset_clone_sync(void *arg, dmu_tx_t *tx) const char *tail; dsl_dataset_t *origin, *ds; uint64_t obj; - char namebuf[MAXNAMELEN]; + char namebuf[ZFS_MAX_DATASET_NAME_LEN]; VERIFY0(dsl_dir_hold(dp, doca->doca_clone, FTAG, &pdd, &tail)); VERIFY0(dsl_dataset_hold(dp, doca->doca_origin, FTAG, &origin)); @@ -2047,7 +2053,7 @@ dmu_objset_get_user(objset_t *os) /* * Determine name of filesystem, given name of snapshot. - * buf must be at least MAXNAMELEN bytes + * buf must be at least ZFS_MAX_DATASET_NAME_LEN bytes */ int dmu_fsname(const char *snapname, char *buf) @@ -2055,7 +2061,7 @@ dmu_fsname(const char *snapname, char *buf) char *atp = strchr(snapname, '@'); if (atp == NULL) return (SET_ERROR(EINVAL)); - if (atp - snapname >= MAXNAMELEN) + if (atp - snapname >= ZFS_MAX_DATASET_NAME_LEN) return (SET_ERROR(ENAMETOOLONG)); (void) strlcpy(buf, snapname, atp - snapname + 1); return (0); |