Changeset 103067 in vbox for trunk

Timestamp:

Jan 25, 2024 3:31:01 PM (13 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

161313

Message:

Additions: Linux: vboxsf: Prevent array-index-out-of-bounds UBSAN warnings, bugref:10585.

Location:

trunk

Files:

• include/VBox/VBoxGuestLibSharedFoldersInline.h (modified) (1 diff)
• src/VBox/Additions/linux/sharedfolders/dirops.c (modified) (2 diffs)
• src/VBox/Additions/linux/sharedfolders/utils.c (modified) (1 diff)
• src/VBox/Additions/linux/sharedfolders/vfsmod.c (modified) (1 diff)

trunk/include/VBox/VBoxGuestLibSharedFoldersInline.h

@@ -1506 +1506 @@
             pReq->StrPath.u16Size   = (uint16_t)cchPath + 1;
             RT_BCOPY_UNFORTIFIED(pReq->StrPath.String.ach, pszPath, cchPath);
-            pReq->StrPath.String.ach[cchPath] = '\0';
+            *(pReq->StrPath.String.ach + cchPath) = '\0';
 
             {

trunk/src/VBox/Additions/linux/sharedfolders/dirops.c

@@ -493 +493 @@
             AssertLogRelBreak(offEntryInBuf + RT_UOFFSETOF(SHFLDIRINFO, name.String) + cbSrcName <= cbValid);
             AssertLogRelBreak(cchSrcName < cbSrcName);
-            AssertLogRelBreak(pEntry->name.String.ach[cchSrcName] == '\0');
+            AssertLogRelBreak(*(pEntry->name.String.ach + cchSrcName) == '\0');
 
             /*
@@ -501 +501 @@
                 || pEntry->name.String.ach[0] != '.'
                 || (   cchSrcName == 2
-                    && pEntry->name.String.ach[1] != '.')) {
+                    && *(pEntry->name.String.ach + 1) != '.')) {
                 int const   d_type = vbsf_get_d_type(pEntry->Info.Attr.fMode);
                 ino_t const d_ino  = (ino_t)offPos + 0xbeef; /* very fake */

trunk/src/VBox/Additions/linux/sharedfolders/utils.c

@@ -1048 +1048 @@
     else {
         RT_BCOPY_UNFORTIFIED(&tmp->String.utf8[0], p_name, p_len);
-        tmp->String.utf8[p_len] = '/';
-        RT_BCOPY_UNFORTIFIED(&tmp->String.utf8[p_len + 1], d_name, d_len);
-        tmp->String.utf8[p_len + 1 + d_len] = '\0';
+        *(tmp->String.utf8 + p_len) = '/';
+        RT_BCOPY_UNFORTIFIED(tmp->String.utf8 + p_len + 1, d_name, d_len);
+        *(tmp->String.utf8 + p_len + 1 + d_len) = '\0';
     }
 

trunk/src/VBox/Additions/linux/sharedfolders/vfsmod.c

@@ -474 +474 @@
         path->u16Length = 1;
         path->u16Size = 2;
-        path->String.utf8[0] = '/';
-        path->String.utf8[1] = 0;
+        RTStrCopy(path->String.utf8, path->u16Size, "/");
 
         /*