15925 2025-07-03 20:25:17 +0000 Wrong size passed to memcpy in pdb_update_inode leads to missing xattrs when renaming 2025-07-11 02:54:03 +0000 1 1 6 Yocto Project Subprojects Pseudo pseudo master All Multiple RESOLVED FIXED Medium+ normal 5.3 M2 1 daniele.romano mark.hatle mark.hatle randy.macleod yp.pseudo.watcher yp.watcher --- --- No (bug/feature does not impact docs) oldest_to_newest 102413 0 daniele.romano 2025-07-03 20:25:17 +0000 The pdb_update_inode function is unable to find a match and to correctly copy the xattr due to the wrong amount of data copied when cloning msg. The issue is in the following code in pseudo_db.c: 2160 int pdb_update_inode(pseudo_msg_t *msg) { ..... ..... 2191 memcpy(oldmsg, msg, sizeof(msg) + msg->pathlen); 2192 found_existing = !pdb_find_file_path(oldmsg); 2193 if (found_existing) { 2194 /* we have an existing file entry */ 2195 pdb_copy_xattrs(oldmsg, msg); 2196 } The memcpy in line 2191 is copying "sizeof(msg) + msg->pathlen", but msg is a pointer to a pseudo_msg_t. This means that the amount of bytes copied is equal to msg->pathlen plus the size of a pointer and not the pseudo_msg_t itself. This issue will lead to a truncated path copied in oldmsg and to the failure of pdb_find_file_path function on line 2193. The patch attached fixes line 2191 replacing "sizeof(msg)" with "sizeof(pseudo_msg_t)". In addition, it fixes the allocation of the oldmsg buffer at line 2167. This is needed to avoid buffer overflows with paths very close to the maximum expected length that is given by the pseudo_path_max() function. 102414 1 5125 daniele.romano 2025-07-03 20:26:16 +0000 Created attachment 5125 Fix for oldmsg buffer allocation and memcpy data copied 102449 2 mark.hatle 2025-07-11 02:52:52 +0000 The patch was tested, modified a bit and has been pushed. See: https://git.yoctoproject.org/pseudo/commit/?id=d1db9c219abf92f15303486a409292237f1fc790 5125 2025-07-03 20:26:16 +0000 2025-07-03 20:26:16 +0000 Fix for oldmsg buffer allocation and memcpy data copied oldmsg buffer allocation and memcpy fix.patch text/plain 710 daniele.romano ZGlmZiAtLWdpdCBhL3BzZXVkb19kYi5jIGIvcHNldWRvX2RiLmMKaW5kZXggMTRiYWZjYi4uYmRk MmRjYyAxMDA2NDQKLS0tIGEvcHNldWRvX2RiLmMKKysrIGIvcHNldWRvX2RiLmMKQEAgLTIxNjQs NyArMjE2NCw3IEBAIHBkYl91cGRhdGVfaW5vZGUocHNldWRvX21zZ190ICptc2cpIHsKICBpbnQg Zm91bmRfZXhpc3Rpbmc7CiAKICBpZiAoIW9sZG1zZykgewotIG9sZG1zZyA9IG1hbGxvYyhwc2V1 ZG9fcGF0aF9tYXgoKSk7Cisgb2xkbXNnID0gbWFsbG9jKHNpemVvZihwc2V1ZG9fbXNnX3QpICsg cHNldWRvX3BhdGhfbWF4KCkpOwogIH0KIAogIGNoYXIgKnNxbCA9ICJVUERBVEUgZmlsZXMgIgpA QCAtMjE4OCw3ICsyMTg4LDcgQEAgcGRiX3VwZGF0ZV9pbm9kZShwc2V1ZG9fbXNnX3QgKm1zZykg ewogIHBzZXVkb19kaWFnKCJDYW4ndCB1cGRhdGUgdGhlIGlub2RlIG9mIGEgZmlsZSB3aXRob3V0 IGl0cyBwYXRoLlxuIik7CiAgcmV0dXJuIDE7CiAgfQotIG1lbWNweShvbGRtc2csIG1zZywgc2l6 ZW9mKG1zZykgKyBtc2ctPnBhdGhsZW4pOworIG1lbWNweShvbGRtc2csIG1zZywgc2l6ZW9mKHBz ZXVkb19tc2dfdCkgKyBtc2ctPnBhdGhsZW4pOwogIGZvdW5kX2V4aXN0aW5nID0gIXBkYl9maW5k X2ZpbGVfcGF0aChvbGRtc2cpOwogIGlmIChmb3VuZF9leGlzdGluZykgewogIC8qIHdlIGhhdmUg YW4gZXhpc3RpbmcgZmlsZSBlbnRyeSAqLwo=