lib9p: fix nil dereference crash in remove for directory permission check
file->parent can be nil when the file has been previously removed. removefile() deals with this, so skip the permission check in that case and let removefile() error out.
This commit is contained in:
parent
5d8300d2eb
commit
a1b2b9b126
|
@ -365,6 +365,23 @@ rwalk(Req *r, char *error)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
dirwritable(Fid *fid)
|
||||||
|
{
|
||||||
|
File *f;
|
||||||
|
|
||||||
|
f = fid->file;
|
||||||
|
if(f){
|
||||||
|
rlock(f);
|
||||||
|
if(f->parent && !hasperm(f->parent, fid->uid, AWRITE)){
|
||||||
|
runlock(f);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
runlock(f);
|
||||||
|
}
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
sopen(Srv *srv, Req *r)
|
sopen(Srv *srv, Req *r)
|
||||||
{
|
{
|
||||||
|
@ -410,9 +427,7 @@ sopen(Srv *srv, Req *r)
|
||||||
respond(r, Eperm);
|
respond(r, Eperm);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
/* BUG RACE */
|
if((r->ifcall.mode&ORCLOSE) && !dirwritable(r->fid)){
|
||||||
if((r->ifcall.mode&ORCLOSE)
|
|
||||||
&& !hasperm(r->fid->file->parent, r->fid->uid, AWRITE)){
|
|
||||||
respond(r, Eperm);
|
respond(r, Eperm);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
@ -574,8 +589,7 @@ sremove(Srv *srv, Req *r)
|
||||||
respond(r, Eunknownfid);
|
respond(r, Eunknownfid);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
/* BUG RACE */
|
if(!dirwritable(r->fid)){
|
||||||
if(r->fid->file && !hasperm(r->fid->file->parent, r->fid->uid, AWRITE)){
|
|
||||||
respond(r, Eperm);
|
respond(r, Eperm);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue