xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

lib9p: fix nil dereference crash in remove for directory permission check

Browse source 
file->parent can be nil when the file has been previously removed.
removefile() deals with this, so skip the permission check in
that case and let removefile() error out.
This commit is contained in:
cinap_lenrek 2014-09-19 05:22:26 +02:00
parent 5d8300d2eb
commit a1b2b9b126
1 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

24
sys/src/lib9p/srv.c
View file

@ -365,6 +365,23 @@ rwalk(Req *r, char *error)
}
}
static int
dirwritable(Fid *fid)
{
File *f;
f = fid->file;
if(f){
rlock(f);
if(f->parent && !hasperm(f->parent, fid->uid, AWRITE)){
runlock(f);
return 0;
}
runlock(f);
}
return 1;
}
static void
sopen(Srv *srv, Req *r)
{
@ -410,9 +427,7 @@ sopen(Srv *srv, Req *r)
respond(r, Eperm);
return;
}
/* BUG RACE */
if((r->ifcall.mode&ORCLOSE)
&& !hasperm(r->fid->file->parent, r->fid->uid, AWRITE)){
if((r->ifcall.mode&ORCLOSE) && !dirwritable(r->fid)){
respond(r, Eperm);
return;
}
@ -574,8 +589,7 @@ sremove(Srv *srv, Req *r)
respond(r, Eunknownfid);
return;
}
/* BUG RACE */
if(r->fid->file && !hasperm(r->fid->file->parent, r->fid->uid, AWRITE)){
if(!dirwritable(r->fid)){
respond(r, Eperm);
return;
}