Buffer overflow in dump, as reported from Bugtraq

[dump.git] / restore / dirs.c

diff --git a/restore/dirs.c b/restore/dirs.c
index a6611c678d14a9845a98c186ee6867126f44ce2d..2d559fea248efd3078ad63a21c6eb5cf8e9098d1 100644 (file)
--- a/restore/dirs.c
+++ b/restore/dirs.c
@@ -2,8 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *      Stelian Pop <pop@cybercable.fr>, 1999 
- *
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*
@@ -45,11 +44,8 @@
  */
 
 #ifndef lint
-#if 0
-static char sccsid[] = "@(#)dirs.c     8.7 (Berkeley) 5/1/95";
-#endif
 static const char rcsid[] =
-       "$Id: dirs.c,v 1.4 1999/10/11 13:08:08 stelian Exp $";
+       "$Id: dirs.c,v 1.9 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -383,10 +379,6 @@ putdir(char *buf, size_t size)
                        if (Bcvt)
                                swabst((u_char *)"is", (u_char *) dp);
                        if (oldinofmt && dp->d_ino != 0) {
-#ifdef __linux__
-                               if (Bcvt)
-                                       swabst((u_char *)"s", (u_char *)&dp->d_namlen);
-#else
 #                              if BYTE_ORDER == BIG_ENDIAN
                                        if (Bcvt)
                                                dp->d_namlen = dp->d_type;
@@ -394,16 +386,8 @@ putdir(char *buf, size_t size)
                                        if (!Bcvt)
                                                dp->d_namlen = dp->d_type;
 #                              endif
-#endif /* __linux__ */
                                dp->d_type = DT_UNKNOWN;
                        }
-#ifdef __linux__
-                       /*
-                        * Horrible hack to read FreeBSD 2.0 dumps
-                        */
-                       if (!oldinofmt)
-                               swabst((u_char *)"6bs", (u_char *) dp);
-#endif /* __linux__ */
 #ifdef DIRDEBUG
                        printf ("reclen = %d, namlen = %d, type = %d\n",
                                dp->d_reclen, dp->d_namlen, dp->d_type);
@@ -412,7 +396,7 @@ putdir(char *buf, size_t size)
                        if ((dp->d_reclen & 0x3) != 0 ||
                            dp->d_reclen > i ||
                            dp->d_reclen < DIRSIZ(0, dp) ||
-                           dp->d_namlen > NAME_MAX) {
+                           dp->d_namlen > MAXNAMLEN) {
                                Vprintf(stdout, "Mangled directory: ");
                                if ((dp->d_reclen & 0x3) != 0)
                                        Vprintf(stdout,
@@ -421,10 +405,10 @@ putdir(char *buf, size_t size)
                                        Vprintf(stdout,
                                           "reclen less than DIRSIZ (%d < %d) ",
                                           dp->d_reclen, DIRSIZ(0, dp));
-                               if (dp->d_namlen > NAME_MAX)
+                               if (dp->d_namlen > MAXNAMLEN)
                                        Vprintf(stdout,
                                           "reclen name too big (%d > %d) ",
-                                          dp->d_namlen, NAME_MAX);
+                                          dp->d_namlen, MAXNAMLEN);
                                Vprintf(stdout, "\n");
                                loc += i;
                                continue;