Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / tape.c

diff --git a/dump/tape.c b/dump/tape.c
index 7790cc4e4bd6a30b8a8d6791699383265493195c..5a50ff95aaf66e814efad447026639090b8814e9 100644 (file)
--- a/dump/tape.c
+++ b/dump/tape.c
@@ -2,7 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *     Stelian Pop <pop@cybercable.fr>, 1999 
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*-
@@ -40,7 +40,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: tape.c,v 1.9 1999/11/21 16:01:47 tiniou Exp $";
+       "$Id: tape.c,v 1.14 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #ifdef __linux__
@@ -311,6 +311,8 @@ statussig(int notused)
 #else
        (void) time((time_t *) &tnow);
 #endif
+       if (blockswritten > tapesize)
+               tapesize = blockswritten;
        deltat = tstart_writing - tnow + (1.0 * (tnow - tstart_writing))
                / blockswritten * tapesize;
        (void)snprintf(msgbuf, sizeof(msgbuf),
@@ -713,8 +715,8 @@ restore_check_point:
                 */
                tapeno++;               /* current tape sequence */
                if (Mflag) {
-                       snprintf(tape, NAME_MAX, "%s%03d", tapeprefix, tapeno);
-                       tape[NAME_MAX - 1] = '\0';
+                       snprintf(tape, MAXPATHLEN, "%s%03d", tapeprefix, tapeno);
+                       tape[MAXPATHLEN - 1] = '\0';
                        msg("Dumping volume %d on %s\n", tapeno, tape);
                }
                else if (nexttape || strchr(tapeprefix, ',')) {
@@ -725,15 +727,16 @@ restore_check_point:
                                nexttape = p + 1;
                        } else
                                nexttape = NULL;
-                       strncpy(tape, tapeprefix, NAME_MAX);
-                       tape[NAME_MAX - 1] = '\0';
+                       strncpy(tape, tapeprefix, MAXPATHLEN);
+                       tape[MAXPATHLEN - 1] = '\0';
                        msg("Dumping volume %d on %s\n", tapeno, tape);
                }
 #ifdef RDUMP
-               while ((tapefd = (host ? rmtopen(tape, 2) :
-                       pipeout ? 1 : open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
+               while ((tapefd = (host ? rmtopen(tape, 2) : pipeout ? 
+                       fileno(stdout) : 
+                       open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #else
-               while ((tapefd = (pipeout ? 1 :
+               while ((tapefd = (pipeout ? fileno(stdout) :
                                  open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #endif
                    {
@@ -1029,8 +1032,10 @@ atomic_read(int fd, void *buf, size_t count)
 {
        int got, need = count;
 
-       while ((got = read(fd, buf, need)) > 0 && (need -= got) > 0)
-               (char *)buf += got;
+       do {
+               while ((got = read(fd, buf, need)) > 0 && (need -= got) > 0)
+                       (char *)buf += got;
+       } while (got == -1 && errno == EINTR);
        return (got < 0 ? got : count - need);
 }
 
@@ -1044,7 +1049,9 @@ atomic_write(int fd, const void *buf, size_t count)
 {
        int got, need = count;
 
-       while ((got = write(fd, buf, need)) > 0 && (need -= got) > 0)
-               (char *)buf += got;
+       do {
+               while ((got = write(fd, buf, need)) > 0 && (need -= got) > 0)
+                       (char *)buf += got;
+       } while (got == -1 && errno == EINTR);
        return (got < 0 ? got : count - need);
 }