fix potential overflow in nfs_pread_mcb
[deb_libnfs.git] / lib / libnfs.c
index c697895f68c4ab88893ee18111306575b22f34a6..4f0650f41abbe9ccca78bfc7a01fece238b9e706 100644 (file)
@@ -1230,6 +1230,84 @@ int nfs_stat_async(struct nfs_context *nfs, const char *path, nfs_cb cb, void *p
 }
 
 
+/*
+ * Async nfs_stat64()
+ */
+static void nfs_stat64_1_cb(struct rpc_context *rpc, int status, void *command_data, void *private_data)
+{
+       GETATTR3res *res;
+       struct nfs_cb_data *data = private_data;
+       struct nfs_context *nfs = data->nfs;
+       struct nfs_stat_64 st;
+
+       assert(rpc->magic == RPC_CONTEXT_MAGIC);
+
+       if (status == RPC_STATUS_ERROR) {
+               data->cb(-EFAULT, nfs, command_data, data->private_data);
+               free_nfs_cb_data(data);
+               return;
+       }
+       if (status == RPC_STATUS_CANCEL) {
+               data->cb(-EINTR, nfs, "Command was cancelled", data->private_data);
+               free_nfs_cb_data(data);
+               return;
+       }
+
+       res = command_data;
+       if (res->status != NFS3_OK) {
+               rpc_set_error(nfs->rpc, "NFS: GETATTR of %s failed with %s(%d)", data->saved_path, nfsstat3_to_str(res->status), nfsstat3_to_errno(res->status));
+               data->cb(nfsstat3_to_errno(res->status), nfs, rpc_get_error(nfs->rpc), data->private_data);
+               free_nfs_cb_data(data);
+               return;
+       }
+
+        st.nfs_dev     = -1;
+        st.nfs_ino     = res->GETATTR3res_u.resok.obj_attributes.fileid;
+        st.nfs_mode    = res->GETATTR3res_u.resok.obj_attributes.mode;
+       if (res->GETATTR3res_u.resok.obj_attributes.type == NF3DIR) {
+               st.nfs_mode |= S_IFDIR ;
+       }
+       if (res->GETATTR3res_u.resok.obj_attributes.type == NF3REG) {
+               st.nfs_mode |= S_IFREG ;
+       }
+        st.nfs_nlink   = res->GETATTR3res_u.resok.obj_attributes.nlink;
+        st.nfs_uid     = res->GETATTR3res_u.resok.obj_attributes.uid;
+        st.nfs_gid     = res->GETATTR3res_u.resok.obj_attributes.gid;
+        st.nfs_rdev    = 0;
+        st.nfs_size    = res->GETATTR3res_u.resok.obj_attributes.size;
+        st.nfs_atime   = res->GETATTR3res_u.resok.obj_attributes.atime.seconds;
+        st.nfs_mtime   = res->GETATTR3res_u.resok.obj_attributes.mtime.seconds;
+        st.nfs_ctime   = res->GETATTR3res_u.resok.obj_attributes.ctime.seconds;
+
+       data->cb(0, nfs, &st, data->private_data);
+       free_nfs_cb_data(data);
+}
+
+static int nfs_stat64_continue_internal(struct nfs_context *nfs, struct nfs_cb_data *data)
+{
+       struct GETATTR3args args;
+
+       memset(&args, 0, sizeof(GETATTR3args));
+       args.object = data->fh;
+
+       if (rpc_nfs3_getattr_async(nfs->rpc, nfs_stat64_1_cb, &args, data) != 0) {
+               rpc_set_error(nfs->rpc, "RPC error: Failed to send STAT GETATTR call for %s", data->path);
+               data->cb(-ENOMEM, nfs, rpc_get_error(nfs->rpc), data->private_data);
+               free_nfs_cb_data(data);
+               return -1;
+       }
+       return 0;
+}
+
+int nfs_stat64_async(struct nfs_context *nfs, const char *path, nfs_cb cb, void *private_data)
+{
+       if (nfs_lookuppath_async(nfs, path, cb, private_data, nfs_stat64_continue_internal, NULL, NULL, 0) != 0) {
+               rpc_set_error(nfs->rpc, "Out of memory: failed to start parsing the path components");
+               return -1;
+       }
+
+       return 0;
+}
 
 /*
  * Async open()
@@ -1510,9 +1588,14 @@ static void nfs_pread_mcb(struct rpc_context *rpc, int status, void *command_dat
                        data->error = 1;
                } else  {
                        if (res->READ3res_u.resok.count > 0) {
-                               memcpy(&data->buffer[mdata->offset - data->start_offset], res->READ3res_u.resok.data.data_val, res->READ3res_u.resok.count);
-                               if ((unsigned)data->max_offset < mdata->offset + res->READ3res_u.resok.count) {
-                                       data->max_offset = mdata->offset + res->READ3res_u.resok.count;
+                               if (res->READ3res_u.resok.count <= mdata->count) {
+                                       memcpy(&data->buffer[mdata->offset - data->start_offset], res->READ3res_u.resok.data.data_val, res->READ3res_u.resok.count);
+                                       if ((unsigned)data->max_offset < mdata->offset + res->READ3res_u.resok.count) {
+                                               data->max_offset = mdata->offset + res->READ3res_u.resok.count;
+                                       }
+                               } else {
+                                       rpc_set_error(nfs->rpc, "NFS: Read overflow. Server has sent more data than requested!");
+                                       data->error = 1;
                                }
                        }
                }
@@ -1578,6 +1661,9 @@ int nfs_pread_async(struct nfs_context *nfs, struct nfsfh *nfsfh, uint64_t offse
                return 0;
        }
 
+       assert(count > 0);
+       assert(data->num_calls == 0);
+
        /* trying to read more than maximum server read size, we has to chop it up into smaller
         * reads and collect into a reassembly buffer.
         * we send all reads in parallel so that performance is still good.
@@ -1605,6 +1691,8 @@ int nfs_pread_async(struct nfs_context *nfs, struct nfsfh *nfsfh, uint64_t offse
                mdata = malloc(sizeof(struct nfs_mcb_data));
                if (mdata == NULL) {
                        rpc_set_error(nfs->rpc, "out of memory: failed to allocate nfs_mcb_data structure");
+                       if (data->num_calls == 0)
+                               free_nfs_cb_data(data);
                        return -1;
                }
                memset(mdata, 0, sizeof(struct nfs_mcb_data));
@@ -1621,6 +1709,8 @@ int nfs_pread_async(struct nfs_context *nfs, struct nfsfh *nfsfh, uint64_t offse
                        rpc_set_error(nfs->rpc, "RPC error: Failed to send READ call for %s", data->path);
                        data->cb(-ENOMEM, nfs, rpc_get_error(nfs->rpc), data->private_data);
                        free(mdata);
+                       if (data->num_calls == 0)
+                               free_nfs_cb_data(data);
                        return -1;
                }
 
@@ -2647,14 +2737,15 @@ static void nfs_opendir3_cb(struct rpc_context *rpc, int status, void *command_d
        rdpe_cb_data->getattrcount--;
 
        if (status == RPC_STATUS_ERROR) {
+               rpc_set_error(nfs->rpc, "LOOKUP during READDIRPLUS emulation "
+                             "failed with RPC_STATUS_ERROR");
                rdpe_cb_data->status = RPC_STATUS_ERROR;
        }
        if (status == RPC_STATUS_CANCEL) {
+               rpc_set_error(nfs->rpc, "LOOKUP during READDIRPLUS emulation "
+                             "failed with RPC_STATUS_CANCEL");
                rdpe_cb_data->status = RPC_STATUS_CANCEL;
        }
-       if (status == RPC_STATUS_SUCCESS && res->status != NFS3_OK) {
-               rdpe_cb_data->status = RPC_STATUS_ERROR;
-       }
        if (status == RPC_STATUS_SUCCESS && res->status == NFS3_OK) {
                if (res->LOOKUP3res_u.resok.obj_attributes.attributes_follow) {
                        fattr3 *attributes = &res->LOOKUP3res_u.resok.obj_attributes.post_op_attr_u.attributes;
@@ -2676,7 +2767,10 @@ static void nfs_opendir3_cb(struct rpc_context *rpc, int status, void *command_d
 
        if (rdpe_cb_data->getattrcount == 0) {
                if (rdpe_cb_data->status != RPC_STATUS_SUCCESS) {
-                       data->cb(-ENOMEM, nfs, rpc_get_error(nfs->rpc), data->private_data);
+                       rpc_set_error(nfs->rpc, "READDIRPLUS emulation "
+                             "failed: %s", rpc_get_error(rpc));
+                       data->cb(-ENOMEM, nfs, rpc_get_error(nfs->rpc),
+                               data->private_data);
                        nfs_free_nfsdir(nfsdir);
                } else {
                        data->cb(0, nfs, nfsdir, data->private_data);