Explorar o código

[LibOS] fs/proc/fs.c: Use proc_dir.size instead of proc_dir.name == NULL

Previously, there was a bug in proc_match_name(): iteration over a
proc_dir array relied on proc_dir.name == proc_dir.nm_ops == NULL.
However, there is no sentinel NULL item in actual arrays, which led to
undefined behavior. This commit changes the for-loop condition to
check proc_dir.size and not rely on the NULL item.
Dmitrii Kuvaiskii %!s(int64=6) %!d(string=hai) anos
pai
achega
05fa2ba8c0
Modificáronse 1 ficheiros con 10 adicións e 2 borrados
  1. 10 2
      LibOS/shim/src/fs/proc/fs.c

+ 10 - 2
LibOS/shim/src/fs/proc/fs.c

@@ -145,6 +145,7 @@ static int proc_match_name(const char* trim_name, const struct proc_ent** ent) {
     const char* token           = trim_name;
     const char* next_token;
     const struct proc_ent* tmp  = proc_root.ent;
+    const struct proc_ent* end  = tmp + proc_root.size;
     const struct proc_ent* last = NULL;
 
     if (*token == '/')
@@ -153,7 +154,7 @@ static int proc_match_name(const char* trim_name, const struct proc_ent** ent) {
     while (token) {
         int tlen = token_len(token, &next_token);
 
-        for (; tmp->name || tmp->nm_ops; tmp++) {
+        for (; tmp < end; tmp++) {
             if (tmp->name && !memcmp(tmp->name, token, tlen))
                 goto found;
 
@@ -164,10 +165,17 @@ static int proc_match_name(const char* trim_name, const struct proc_ent** ent) {
         return -ENOENT;
 
     found:
-        if (!tmp->dir && next_token)
+        if (!next_token) {
+            /* found the entry, break out of the while loop */
+            last = tmp;
+            break;
+        }
+
+        if (!tmp->dir)
             return -ENOENT;
 
         last  = tmp;
+        end   = tmp->dir->ent + tmp->dir->size;
         tmp   = tmp->dir->ent;
         token = next_token;
     }