* libc/posix/readdir_r.c: Fix potential read past dirp->dd_buf.

diff --git a/newlib/ChangeLog b/newlib/ChangeLog
index 93c1334265785afd3b536bcb84d497a46429b8e3..0a819332a3af945a39599a7bb49d01c2f33d97bf 100644 (file)
--- a/newlib/ChangeLog
+++ b/newlib/ChangeLog
@@ -1,4 +1,8 @@
-2013-06-13  Bin Cheng  <bin.cheng@arm.com>
+2013-06-19  Terraneo Federico  <fede.tft@hotmail.it>
+
+       * libc/posix/readdir_r.c: Fix potential read past dirp->dd_buf.
+
+2013-06-13  Bir Cheng  <bin.cheng@arm.com>
 
        * README: Add description for NEWLIB's feature customizing
        configuration options.

diff --git a/newlib/libc/posix/readdir_r.c b/newlib/libc/posix/readdir_r.c
index b9a0b9024f9e0866ad4113ff0a4178406b298dc9..eafbeca6a4219c46344997fa996ba4dd77c1ae6f 100644 (file)
--- a/newlib/libc/posix/readdir_r.c
+++ b/newlib/libc/posix/readdir_r.c
@@ -42,6 +42,7 @@ static char sccsid[] = "@(#)readdir.c 5.7 (Berkeley) 6/1/90";
 #include <dirent.h>
 #include <errno.h>
 #include <string.h>
+#include <sys/param.h>
 
 extern int getdents (int fd, void *dp, int count);
 
@@ -84,16 +85,17 @@ struct dirent *tmpdp;
       continue;
     }
     tmpdp = (struct dirent *)(dirp->dd_buf + dirp->dd_loc);
-    memcpy (dp, tmpdp, sizeof(struct dirent));
 
-    if (dp->d_reclen <= 0 ||
-       dp->d_reclen > dirp->dd_len + 1 - dirp->dd_loc) {
+    if (tmpdp->d_reclen <= 0 ||
+       tmpdp->d_reclen > dirp->dd_len + 1 - dirp->dd_loc) {
 #ifdef HAVE_DD_LOCK
       __lock_release_recursive(dirp->dd_lock);
 #endif
       *dpp = NULL;
       return -1;
     }
+    memcpy (dp, tmpdp, MIN (tmpdp->d_reclen, sizeof (struct dirent)));
+    
     dirp->dd_loc += dp->d_reclen;
     if (dp->d_ino == 0)
       continue;