Re: CVS commit: src/libexec/ld.elf_so

[Takeshi Nakayama <tn%catvmics.ne.jp@localhost>]

>>> Andrew Doran <ad%netbsd.org@localhost> wrote

> Module Name:  src
> Committed By: ad
> Date:         Tue Jun  3 18:36:59 UTC 2008
> 
> Modified Files:
>       src/libexec/ld.elf_so: paths.c
> 
> Log Message:
> Try read() on ld.so.conf. If the file is small, it avoids stat+mmap+munmap.

This change cannot avoid stat and may cause buffer overflow at read
if file is larger than sizeof(small).

How about this patch?

Takeshi Nakayama


Index: paths.c
===================================================================
RCS file: /cvsroot/src/libexec/ld.elf_so/paths.c,v
retrieving revision 1.38
diff -u -d -r1.38 paths.c
--- paths.c     3 Jun 2008 18:36:59 -0000       1.38
+++ paths.c     4 Jun 2008 11:39:58 -0000
@@ -340,8 +340,7 @@
        char *buf, small[128];
        const char *b, *ep, *ptr;
        struct stat st;
-       size_t sz;
-       ssize_t rsz;
+       ssize_t sz;
        Search_Path **head_p = path_p;
 
        if ((fd = open(fname, O_RDONLY)) == -1) {
@@ -349,24 +348,25 @@
                return;
        }
 
-       if (fstat(fd, &st) == -1) {
-               /* Complain */
-               xwarn("fstat: %s", fname);
-               return;
-       }
-
-       sz = (size_t) st.st_size;
-
        /* Try to avoid mmap/stat on the file. */
        buf = small;
        buf[0] = '\0';
-       rsz = read(fd, buf, sz);
-       if (rsz == -1) {
+       sz = read(fd, buf, sizeof(small));
+       if (sz == -1) {
                xwarn("read: %s", fname);
                (void)close(fd);
                return;
        }
-       if (rsz >= sizeof(small)) {
+       if (sz >= sizeof(small)) {
+               if (fstat(fd, &st) == -1) {
+                       /* Complain */
+                       xwarn("fstat: %s", fname);
+                       (void)close(fd);
+                       return;
+               }
+
+               sz = (ssize_t) st.st_size;
+
                buf = mmap(0, sz, PROT_READ, MAP_SHARED|MAP_FILE, fd, 0);
                if (buf == MAP_FAILED) {
                        xwarn("mmap: %s", fname);