On 18 August 2012 22:56, Dmitry V. Levin <l...@altlinux.org> wrote:
> In case when TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64, the last
> byte of the target dirent structure (aka d_type byte) was never copied
> from the host dirent structure, thus breaking everything that relies
> on valid d_type value, e.g. glob(3).
>
> Signed-off-by: Dmitry V. Levin <l...@altlinux.org>
> ---
> linux-user/syscall.c | 8 ++++----
> linux-user/syscall_defs.h | 3 ++-
> 2 files changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 41c869b..adc3270 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -7030,10 +7030,10 @@ abi_long do_syscall(void *cpu_env, int num, abi_long
> arg1,
> tde->d_ino = tswapal(de->d_ino);
> tde->d_off = tswapal(de->d_off);
> tnamelen = treclen - (2 * sizeof(abi_long) + 2);
Incidentally I think this would be clearer as
tnamelen = treclen - offsetof(target_dirent, d_name);
> - if (tnamelen > 256)
> - tnamelen = 256;
> - /* XXX: may not be correct */
> - pstrcpy(tde->d_name, tnamelen, de->d_name);
> + if (tnamelen > sizeof(tde->d_name)) {
> + tnamelen = sizeof(tde->d_name);
> + }
> + memcpy(tde->d_name, de->d_name, tnamelen);
Why are we limiting the amount copied to sizeof(tde->d_name) in the
first place? The only actual limit we care about is that we mustn't
overrun the guest's overall buffer size (and I assert that we can't
do that because sizeof(target_dirent) <= sizeof(linux_dirent). We
could even assert in the code that we don't write more than 'count'
bytes to the guest buffer...
As far as I can tell the kernel doesn't impose any particular limit
on the filesize; we should just copy all of the record as defined
by d_reclen.
> de = (struct linux_dirent *)((char *)de + reclen);
> len -= reclen;
> tde = (struct target_dirent *)((char *)tde + treclen);
> diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
> index 2cfda5a..19fe414 100644
> --- a/linux-user/syscall_defs.h
> +++ b/linux-user/syscall_defs.h
> @@ -258,7 +258,8 @@ struct target_dirent {
> abi_long d_ino;
> abi_long d_off;
> unsigned short d_reclen;
> - char d_name[256]; /* We must not include limits.h! */
> + char d_name[257]; /* 257 = NAME_MAX + '\0' + d_type, */
> + /* we must not include limits.h! */
> };
...and if we did that we could make d_name[] a flexible
array member, ie "char d_name[];".
-- PMM
