[PATCH] io:nftw/ftw:fix stack overflow when large nopenfd [BZ #26353]

[Xiaoming Ni]

In ftw_startup(), call alloca to apply for a large amount of stack space.
When descriptors is very large, stack overflow is triggered. BZ #26353

To fix the problem:
1. Set the upper limit of descriptors to getdtablesize().
2. Replace alloca() in ftw_startup() with malloc().
---
 io/Makefile      |  3 ++-
 io/ftw.c         | 19 +++++++++++++++++--
 io/tst-bz26353.c | 20 ++++++++++++++++++++
 3 files changed, 39 insertions(+), 3 deletions(-)
 create mode 100644 io/tst-bz26353.c

diff --git a/io/Makefile b/io/Makefile
index cf380f3516..0f674c317f 100644
--- a/io/Makefile
+++ b/io/Makefile
@@ -74,7 +74,8 @@ tests		:= test-utime test-stat test-stat2 test-lfs tst-getcwd \
 		   tst-posix_fallocate tst-posix_fallocate64 \
 		   tst-fts tst-fts-lfs tst-open-tmpfile \
 		   tst-copy_file_range tst-getcwd-abspath tst-lockf \
-		   tst-ftw-lnk tst-file_change_detection tst-lchmod
+		   tst-ftw-lnk tst-file_change_detection tst-lchmod \
+		   tst-bz26353
 
 # Likewise for statx, but we do not need static linking here.
 tests-internal += tst-statx
diff --git a/io/ftw.c b/io/ftw.c
index 8c79d29a9e..094aada50c 100644
--- a/io/ftw.c
+++ b/io/ftw.c
@@ -643,18 +643,32 @@ ftw_startup (const char *dir, int is_nftw, void *func, int descriptors,
       __set_errno (ENOENT);
       return -1;
     }
+  if (descriptors > getdtablesize())
+    {
+      __set_errno (EINVAL);
+      return -1;
+    }
 
   data.maxdir = descriptors < 1 ? 1 : descriptors;
   data.actdir = 0;
-  data.dirstreams = (struct dir_data **) alloca (data.maxdir
+  data.dirstreams = (struct dir_data **) malloc (data.maxdir
 						 * sizeof (struct dir_data *));
+  if (data.dirstreams == NULL)
+    {
+      __set_errno (ENOMEM);
+      return -1;
+    }
   memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data *));
 
   /* PATH_MAX is always defined when we get here.  */
   data.dirbufsize = MAX (2 * strlen (dir), PATH_MAX);
   data.dirbuf = (char *) malloc (data.dirbufsize);
   if (data.dirbuf == NULL)
-    return -1;
+    {
+      free (data.dirstreams);
+      __set_errno (ENOMEM);
+      return -1;
+    }
   cp = __stpcpy (data.dirbuf, dir);
   /* Strip trailing slashes.  */
   while (cp > data.dirbuf + 1 && cp[-1] == '/')
@@ -805,6 +819,7 @@ ftw_startup (const char *dir, int is_nftw, void *func, int descriptors,
   __tdestroy (data.known_objects, free);
   free (data.dirbuf);
   __set_errno (save_err);
+  free (data.dirstreams);
 
   return result;
 }
diff --git a/io/tst-bz26353.c b/io/tst-bz26353.c
new file mode 100644
index 0000000000..4ab3d4b61f
--- /dev/null
+++ b/io/tst-bz26353.c
@@ -0,0 +1,20 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <ftw.h>
+#include <sys/stat.h>
+
+int my_func(const char *file , const struct stat *sb ,int flag)
+{
+        printf("%s\n",  file);
+        return 0;
+}
+
+int main(int argc, char *argv[])
+{
+	mkdir("./tst-bz26353", 0755);
+	/*Check whether stack overflow occurs*/
+        ftw("./tst-bz26353", my_func, 8192*1024);
+	rmdir("./tst-bz26353");
+        return 0;
+}
-- 
2.27.0