The EXT2_IOC_[GS]ETFLAGS ioctls take longs as arguments, however this code only
reserves enough storage for an int. The kernel drivers (so far) don't transfer
more than an int but FUSE sees the long and assumes that it's ok to write the
full size of the long, which crashes if sizeof(long) > sizeof(int).
Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
---
lib/e2p/fgetflags.c | 3 ++-
lib/e2p/fsetflags.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/lib/e2p/fgetflags.c b/lib/e2p/fgetflags.c
index 2af8462..bfa87f2 100644
--- a/lib/e2p/fgetflags.c
+++ b/lib/e2p/fgetflags.c
@@ -66,7 +66,8 @@ int fgetflags (const char * name, unsigned long * flags)
return 0;
#else /* !HAVE_STAT_FLAGS || (APPLE_DARWIN && HAVE_EXT2_IOCTLS) */
#if HAVE_EXT2_IOCTLS
- int fd, r, f, save_errno = 0;
+ int fd, r, save_errno = 0;
+ unsigned long f;
if (!lstat(name, &buf) &&
!S_ISREG(buf.st_mode) && !S_ISDIR(buf.st_mode)) {
diff --git a/lib/e2p/fsetflags.c b/lib/e2p/fsetflags.c
index 167d16e..050cb4a 100644
--- a/lib/e2p/fsetflags.c
+++ b/lib/e2p/fsetflags.c
@@ -71,7 +71,8 @@ int fsetflags (const char * name, unsigned long flags)
return chflags (name, bsd_flags);
#else /* !HAVE_CHFLAGS || (APPLE_DARWIN && HAVE_EXT2_IOCTLS) */
#if HAVE_EXT2_IOCTLS
- int fd, r, f, save_errno = 0;
+ int fd, r, save_errno = 0;
+ unsigned long f;
struct stat buf;
if (!lstat(name, &buf) &&
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
