Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / tape.c

diff --git a/dump/tape.c b/dump/tape.c
index 1b28c41e6e6307a9a9f662d36fc243c0b28045c3..5a50ff95aaf66e814efad447026639090b8814e9 100644 (file)
--- a/dump/tape.c
+++ b/dump/tape.c
@@ -2,7 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *     Stelian Pop <pop@cybercable.fr>, 1999 
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*-
@@ -40,7 +40,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: tape.c,v 1.7 1999/11/02 09:35:56 tiniou Exp $";
+       "$Id: tape.c,v 1.14 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #ifdef __linux__
@@ -81,9 +81,10 @@ static const char rcsid[] =
 int    write(), read();
 #endif
 
-#ifdef __linux__
+#ifdef __linux__
 #include <ext2fs/ext2fs.h>
 #endif
+
 #include "dump.h"
 
 int    writesize;              /* size of malloc()ed buffer for tape */
@@ -310,6 +311,8 @@ statussig(int notused)
 #else
        (void) time((time_t *) &tnow);
 #endif
+       if (blockswritten > tapesize)
+               tapesize = blockswritten;
        deltat = tstart_writing - tnow + (1.0 * (tnow - tstart_writing))
                / blockswritten * tapesize;
        (void)snprintf(msgbuf, sizeof(msgbuf),
@@ -457,7 +460,7 @@ close_rewind(void)
 {
        trewind();
        (void)do_stats();
-       if (nexttape)
+       if (nexttape || Mflag)
                return;
        if (!nogripe) {
                msg("Change Volumes: Mount volume #%d\n", tapeno+1);
@@ -711,21 +714,29 @@ restore_check_point:
                 * the remaining names for subsequent volumes.
                 */
                tapeno++;               /* current tape sequence */
-               if (nexttape || strchr(tape, ',')) {
+               if (Mflag) {
+                       snprintf(tape, MAXPATHLEN, "%s%03d", tapeprefix, tapeno);
+                       tape[MAXPATHLEN - 1] = '\0';
+                       msg("Dumping volume %d on %s\n", tapeno, tape);
+               }
+               else if (nexttape || strchr(tapeprefix, ',')) {
                        if (nexttape && *nexttape)
-                               tape = nexttape;
-                       if ((p = strchr(tape, ',')) != NULL) {
+                               tapeprefix = nexttape;
+                       if ((p = strchr(tapeprefix, ',')) != NULL) {
                                *p = '\0';
                                nexttape = p + 1;
                        } else
                                nexttape = NULL;
+                       strncpy(tape, tapeprefix, MAXPATHLEN);
+                       tape[MAXPATHLEN - 1] = '\0';
                        msg("Dumping volume %d on %s\n", tapeno, tape);
                }
 #ifdef RDUMP
-               while ((tapefd = (host ? rmtopen(tape, 2) :
-                       pipeout ? 1 : open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
+               while ((tapefd = (host ? rmtopen(tape, 2) : pipeout ? 
+                       fileno(stdout) : 
+                       open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #else
-               while ((tapefd = (pipeout ? 1 :
+               while ((tapefd = (pipeout ? fileno(stdout) :
                                  open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #endif
                    {
@@ -908,9 +919,9 @@ doslave(int cmd, int slave_number)
                quit("slave couldn't reopen disk: %s\n", strerror(errno));
 #ifdef __linux__
        ext2fs_close(fs);
-       retval = ext2fs_open(disk, 0, 0, 0, unix_io_manager, &fs);
+       retval = dump_fs_open(disk, &fs);
        if (retval)
-               quit("slave couldn't reopen disk: %s\n", strerror(errno));
+               quit("slave couldn't reopen disk: %s\n", error_message(retval));
 #endif /* __linux__ */
 
        /*
@@ -1021,8 +1032,10 @@ atomic_read(int fd, void *buf, size_t count)
 {
        int got, need = count;
 
-       while ((got = read(fd, buf, need)) > 0 && (need -= got) > 0)
-               (char *)buf += got;
+       do {
+               while ((got = read(fd, buf, need)) > 0 && (need -= got) > 0)
+                       (char *)buf += got;
+       } while (got == -1 && errno == EINTR);
        return (got < 0 ? got : count - need);
 }
 
@@ -1036,7 +1049,9 @@ atomic_write(int fd, const void *buf, size_t count)
 {
        int got, need = count;
 
-       while ((got = write(fd, buf, need)) > 0 && (need -= got) > 0)
-               (char *)buf += got;
+       do {
+               while ((got = write(fd, buf, need)) > 0 && (need -= got) > 0)
+                       (char *)buf += got;
+       } while (got == -1 && errno == EINTR);
        return (got < 0 ? got : count - need);
 }