ref: cbbb3fb77414ad33be5fec4bbdec98fd977e7b01
parent: 52148dd2250e0f9d2acf152342f0416618dbce80
author: cinap_lenrek <cinap_lenrek@gmx.de>
date: Tue Aug 7 12:11:35 EDT 2012
venti: fix possible nil deref in libventi vtgetreq() and cleanup vacfs (import from sources)
--- a/sys/src/cmd/vac/file.c
+++ b/sys/src/cmd/vac/file.c
@@ -1592,6 +1592,11 @@
f->dir.gid = vtstrdup(dir->gid);
}
+ if(strcmp(f->dir.mid, dir->mid) != 0){+ vtfree(f->dir.mid);
+ f->dir.mid = vtstrdup(dir->mid);
+ }
+
f->dir.mtime = dir->mtime;
f->dir.atime = dir->atime;
@@ -1774,7 +1779,7 @@
char *prefix;
if(vtparsescore(file, &prefix, score) >= 0){- if(strcmp(prefix, "vac") != 0){+ if(prefix == nil || strcmp(prefix, "vac") != 0){ werrstr("not a vac file");return nil;
}
--- a/sys/src/cmd/vac/vacfs.c
+++ b/sys/src/cmd/vac/vacfs.c
@@ -200,12 +200,6 @@
mfd[0] = p[0];
mfd[1] = p[0];
srvfd = p[1];
- }
-
- procrfork(srv, 0, Stacksize, RFFDG|RFNAMEG|RFNOTEG);
-
- if(!stdio){- close(p[0]);
if(defsrv){ srvname = smprint("/srv/%s", defsrv);fd = create(srvname, OWRITE|ORCLOSE, 0666);
@@ -215,6 +209,12 @@
sysfatal("write %s: %r", srvname);free(srvname);
}
+ }
+
+ procrfork(srv, 0, Stacksize, RFFDG|RFNAMEG|RFNOTEG);
+
+ if(!stdio){+ close(p[0]);
if(defmnt){if(mount(srvfd, -1, defmnt, MREPL|MCREATE, "") < 0)
sysfatal("mount %s: %r", defmnt);--- a/sys/src/libventi/server.c
+++ b/sys/src/libventi/server.c
@@ -180,7 +180,9 @@
VtReq *r;
r = _vtqrecv(srv->q);
- vtlog(VtServerLog, "<font size=-1>%T %s:</font> vtgetreq %F<br>\n", ((VtSconn*)r->sc)->c->addr, &r->tx);
+ if (r != nil)
+ vtlog(VtServerLog, "<font size=-1>%T %s:</font> vtgetreq %F<br>\n",
+ ((VtSconn*)r->sc)->c->addr, &r->tx);
return r;
}
--
⑨