Commit 10d033f7 authored by Petr Vandrovec's avatar Petr Vandrovec

[PATCH] FAT/VFAT memory corruption during mount()

This patch fixes memory corruption during vfat mount: one byte
before mount options is overwritten by ',' since strtok->strsep
conversion happened.

This patch also fixes another problem introduced by strtok->strsep
conversion: VFAT requires that FAT does not modify passed options,
but unfortunately FAT driver fails to preserve options string if
there is more than one consecutive comma in option string.
parent eff95566
...@@ -228,8 +228,6 @@ static int parse_options(char *options, int *debug, ...@@ -228,8 +228,6 @@ static int parse_options(char *options, int *debug,
save = 0; save = 0;
savep = NULL; savep = NULL;
while ((this_char = strsep(&options,",")) != NULL) { while ((this_char = strsep(&options,",")) != NULL) {
if (!*this_char)
continue;
if ((value = strchr(this_char,'=')) != NULL) { if ((value = strchr(this_char,'=')) != NULL) {
save = *value; save = *value;
savep = value; savep = value;
...@@ -351,7 +349,7 @@ static int parse_options(char *options, int *debug, ...@@ -351,7 +349,7 @@ static int parse_options(char *options, int *debug,
strncpy(cvf_options,value,100); strncpy(cvf_options,value,100);
} }
if (this_char != options) *(this_char-1) = ','; if (options) *(options-1) = ',';
if (value) *savep = save; if (value) *savep = save;
if (ret == 0) if (ret == 0)
break; break;
......
...@@ -117,8 +117,6 @@ static int parse_options(char *options, struct fat_mount_options *opts) ...@@ -117,8 +117,6 @@ static int parse_options(char *options, struct fat_mount_options *opts)
savep = NULL; savep = NULL;
ret = 1; ret = 1;
while ((this_char = strsep(&options,",")) != NULL) { while ((this_char = strsep(&options,",")) != NULL) {
if (!*this_char)
continue;
if ((value = strchr(this_char,'=')) != NULL) { if ((value = strchr(this_char,'=')) != NULL) {
save = *value; save = *value;
savep = value; savep = value;
...@@ -154,8 +152,8 @@ static int parse_options(char *options, struct fat_mount_options *opts) ...@@ -154,8 +152,8 @@ static int parse_options(char *options, struct fat_mount_options *opts)
else else
ret = 0; ret = 0;
} }
if (this_char != options) if (options)
*(this_char-1) = ','; *(options-1) = ',';
if (value) { if (value) {
*savep = save; *savep = save;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment