Buffer overflow in dump, as reported from Bugtraq

[dump.git] / restore / dirs.c

diff --git a/restore/dirs.c b/restore/dirs.c
index 777a6a6f8a45b830f5d38fbbf753d9726e217ed2..2d559fea248efd3078ad63a21c6eb5cf8e9098d1 100644 (file)
--- a/restore/dirs.c
+++ b/restore/dirs.c
@@ -45,7 +45,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: dirs.c,v 1.7 2000/01/21 10:17:41 stelian Exp $";
+       "$Id: dirs.c,v 1.9 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -379,10 +379,6 @@ putdir(char *buf, size_t size)
                        if (Bcvt)
                                swabst((u_char *)"is", (u_char *) dp);
                        if (oldinofmt && dp->d_ino != 0) {
-#ifdef __linux__
-                               if (Bcvt)
-                                       swabst((u_char *)"s", (u_char *)&dp->d_namlen);
-#else
 #                              if BYTE_ORDER == BIG_ENDIAN
                                        if (Bcvt)
                                                dp->d_namlen = dp->d_type;
@@ -390,16 +386,8 @@ putdir(char *buf, size_t size)
                                        if (!Bcvt)
                                                dp->d_namlen = dp->d_type;
 #                              endif
-#endif /* __linux__ */
                                dp->d_type = DT_UNKNOWN;
                        }
-#ifdef __linux__
-                       /*
-                        * Horrible hack to read FreeBSD 2.0 dumps
-                        */
-                       if (!oldinofmt)
-                               swabst((u_char *)"6bs", (u_char *) dp);
-#endif /* __linux__ */
 #ifdef DIRDEBUG
                        printf ("reclen = %d, namlen = %d, type = %d\n",
                                dp->d_reclen, dp->d_namlen, dp->d_type);
@@ -408,7 +396,7 @@ putdir(char *buf, size_t size)
                        if ((dp->d_reclen & 0x3) != 0 ||
                            dp->d_reclen > i ||
                            dp->d_reclen < DIRSIZ(0, dp) ||
-                           dp->d_namlen > NAME_MAX) {
+                           dp->d_namlen > MAXNAMLEN) {
                                Vprintf(stdout, "Mangled directory: ");
                                if ((dp->d_reclen & 0x3) != 0)
                                        Vprintf(stdout,
@@ -417,10 +405,10 @@ putdir(char *buf, size_t size)
                                        Vprintf(stdout,
                                           "reclen less than DIRSIZ (%d < %d) ",
                                           dp->d_reclen, DIRSIZ(0, dp));
-                               if (dp->d_namlen > NAME_MAX)
+                               if (dp->d_namlen > MAXNAMLEN)
                                        Vprintf(stdout,
                                           "reclen name too big (%d > %d) ",
-                                          dp->d_namlen, NAME_MAX);
+                                          dp->d_namlen, MAXNAMLEN);
                                Vprintf(stdout, "\n");
                                loc += i;
                                continue;