diff --git a/libfuse/lib/fuse.c b/libfuse/lib/fuse.c index 1e9f6245..81a81174 100644 --- a/libfuse/lib/fuse.c +++ b/libfuse/lib/fuse.c @@ -177,6 +177,19 @@ static pthread_key_t fuse_context_key; static pthread_mutex_t fuse_context_lock = PTHREAD_MUTEX_INITIALIZER; static int fuse_context_ref; +static +int +fuse_valid_type(uint32_t const m_) +{ + return (S_ISREG(m_) || + S_ISDIR(m_) || + S_ISLNK(m_) || + S_ISCHR(m_) || + S_ISBLK(m_) || + S_ISFIFO(m_) || + S_ISSOCK(m_)); +} + /* Why was the nodeid:generation logic simplified? @@ -1569,6 +1582,7 @@ fuse_lib_lookup(fuse_req_t req, { pthread_mutex_unlock(&f->lock); reply_entry(req,&e,-ESTALE); + syslog(LOG_ERR,". for nodeid %zu is stale",nodeid); return; } dot->refctr++; @@ -1576,9 +1590,10 @@ fuse_lib_lookup(fuse_req_t req, } else if((name[1] == '.') && (name[2] == '\0')) { - if(nodeid == 1) + if(nodeid == FUSE_ROOT_ID) { reply_entry(req,&e,-ENOENT); + syslog(LOG_ERR,".. for root node????"); return; } @@ -1697,6 +1712,13 @@ fuse_lib_getattr(fuse_req_t req, free_path(f,hdr_->nodeid,path); } + if(buf.st_size > LLONG_MAX) + syslog(LOG_ERR,"%s: %zu size > LLONG_MAX %zu",__FUNCTION__,hdr_->nodeid,buf.st_size); + if(!fuse_valid_type(buf.st_mode)) + syslog(LOG_ERR,"%s: %zu invalid type %x",__FUNCTION__,hdr_->nodeid,buf.st_mode); + if(hdr_->nodeid == FUSE_ROOT_ID && !S_ISDIR(buf.st_mode)) + syslog(LOG_ERR,"%s: rootid not type DIR %x",__FUNCTION__,buf.st_mode); + if(!err) { pthread_mutex_lock(&f->lock); @@ -1818,6 +1840,14 @@ fuse_lib_setattr(fuse_req_t req, f->fs->op.getattr(path,&stbuf,&timeout) : f->fs->op.fgetattr(fi,&stbuf,&timeout)); + if(stbuf.st_size > LLONG_MAX) + syslog(LOG_ERR,"%s: %zu size > LLONG_MAX %zu",__FUNCTION__,hdr_->nodeid,stbuf.st_size); + if(!fuse_valid_type(stbuf.st_mode)) + syslog(LOG_ERR,"%s: %zu invalid type %x",__FUNCTION__,hdr_->nodeid,stbuf.st_mode); + if(hdr_->nodeid == FUSE_ROOT_ID && !S_ISDIR(stbuf.st_mode)) + syslog(LOG_ERR,"%s: rootid not type DIR %x",__FUNCTION__,stbuf.st_mode); + + free_path(f,hdr_->nodeid,path); } diff --git a/libfuse/lib/fuse_lowlevel.c b/libfuse/lib/fuse_lowlevel.c index 37f24dd3..feed5401 100644 --- a/libfuse/lib/fuse_lowlevel.c +++ b/libfuse/lib/fuse_lowlevel.c @@ -19,15 +19,16 @@ #include "fuse_pollhandle.h" #include "fuse_msgbuf.hpp" +#include +#include +#include +#include #include #include -#include #include -#include -#include -#include -#include #include +#include +#include #ifndef F_LINUX_SPECIFIC_BASE #define F_LINUX_SPECIFIC_BASE 1024 @@ -320,6 +321,19 @@ fuse_reply_create(fuse_req_t req, return send_reply_ok(req, &buf, entrysize + sizeof(struct fuse_open_out)); } +static +int +fuse_valid_type(uint32_t const m_) +{ + return (S_ISREG(m_) || + S_ISDIR(m_) || + S_ISLNK(m_) || + S_ISCHR(m_) || + S_ISBLK(m_) || + S_ISFIFO(m_) || + S_ISSOCK(m_)); +} + int fuse_reply_attr(fuse_req_t req, const struct stat *attr, @@ -333,6 +347,11 @@ fuse_reply_attr(fuse_req_t req, arg.attr_valid_nsec = 0; convert_stat(attr,&arg.attr); + if(arg.attr.size > LLONG_MAX) + syslog(LOG_ERR,"fuse_reply_attr: attr.size > LLONG_MAX"); + if(!fuse_valid_type(arg.attr.mode)) + syslog(LOG_ERR,"fuse_reply_attr: invalid type %x",arg.attr.mode); + return send_reply_ok(req,&arg,size); }