The pdb_update_inode function is unable to find a match and to correctly copy the xattr due to the wrong amount of data copied when cloning msg.


The issue is in the following code in pseudo_db.c:

2160 int pdb_update_inode(pseudo_msg_t *msg) {
.....
.....
2191	memcpy(oldmsg, msg, sizeof(msg) + msg->pathlen);
2192	found_existing = !pdb_find_file_path(oldmsg);
2193	if (found_existing) {
2194		/* we have an existing file entry */
2195		pdb_copy_xattrs(oldmsg, msg);
2196	}


The memcpy in line 2191 is copying "sizeof(msg) + msg->pathlen", but msg is a pointer to a pseudo_msg_t. This means that the amount of bytes copied is equal to msg->pathlen plus the size of a pointer and not the pseudo_msg_t itself. This issue will lead to a truncated path copied in oldmsg and to the failure of pdb_find_file_path function on line 2193.

The patch attached fixes line 2191 replacing "sizeof(msg)" with "sizeof(pseudo_msg_t)".

In addition, it fixes the allocation of the oldmsg buffer at line 2167. This is needed to avoid buffer overflows with paths very close to the maximum expected length that is given by the pseudo_path_max() function.