memory corruption in dos_fs_redirect?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

I'm experiencing crashes preceded by

ERROR: MFS: hlist_push: past maximum stack

message (itself simply reproducible, by the way).  It's a segfault and
backtrace shows strcmp() being called by mfs_redirector(), which is nonsense,
IMO.  When looking into mfs.c I noticed the following:

    hlist_index = hlist_push(hlist, sda_cur_psp(sda), bs_pos ? fpath : "");
    sdb_dir_entry(sdb) = 0;
    sdb_p_cluster(sdb) = hlist_index;

    hlists.stack[hlist_index].seq = ++hlists.seq; /* new watch stamp --ms */

When hlist_push fails (it's the "past maximum stack" message), it returns -1,
but the value is used anyway, which seems highly suspicious.

Maybe the fix is simple (let the dos_fs_redirect fail if hlist_push fails),
or maybe the whole "hlist stack" is leaking somehow...  I'm able to spend
some time debugging/fixing that, if pointed into right direction :).

Regards,

-- 
Egon Eckert, Heaven Industries, s.r.o.
E-mail: egon.eckert@xxxxxxxxxxxxxxxxxxxxx

         EARTH
     smog  |   bricks
 AIR  --  mud  -- FIRE
soda water |   tequila
         WATER
 -- with thanks to fortune
--
To unsubscribe from this list: send the line "unsubscribe linux-msdos" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Console]     [Linux Audio]     [Linux for Hams]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite Camping]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Samba]     [Linux Media]     [Fedora Users]

  Powered by Linux