[BACK]Return to scandir.c CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / src / lib / libc / gen

File: [cvs.NetBSD.org] / src / lib / libc / gen / scandir.c (download)

Revision 1.26, Sat Jun 9 23:57:25 2007 UTC (16 years, 9 months ago) by christos
Branch: MAIN
CVS Tags: yamt-pf42-baseX, yamt-pf42-base4, yamt-pf42-base3, yamt-pf42-base2, yamt-pf42-base, yamt-pf42, yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, wrstuden-revivesa-base-3, wrstuden-revivesa-base-2, wrstuden-revivesa-base-1, wrstuden-revivesa-base, wrstuden-revivesa, netbsd-6-base, netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1, netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, netbsd-6, netbsd-5-base, netbsd-5-2-RELEASE, netbsd-5-2-RC1, netbsd-5-2-3-RELEASE, netbsd-5-2-2-RELEASE, netbsd-5-2-1-RELEASE, netbsd-5-2, netbsd-5-1-RELEASE, netbsd-5-1-RC4, netbsd-5-1-RC3, netbsd-5-1-RC2, netbsd-5-1-RC1, netbsd-5-1-5-RELEASE, netbsd-5-1-4-RELEASE, netbsd-5-1-3-RELEASE, netbsd-5-1-2-RELEASE, netbsd-5-1-1-RELEASE, netbsd-5-1, netbsd-5-0-RELEASE, netbsd-5-0-RC4, netbsd-5-0-RC3, netbsd-5-0-RC2, netbsd-5-0-RC1, netbsd-5-0-2-RELEASE, netbsd-5-0-1-RELEASE, netbsd-5-0, netbsd-5, mjf-devfs2-base, mjf-devfs2, matt-premerge-20091211, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus, matt-nb5-pq3-base, matt-nb5-pq3, matt-nb5-mips64-u2-k2-k4-k7-k8-k9, matt-nb5-mips64-u1-k1-k5, matt-nb5-mips64-premerge-20101231, matt-nb5-mips64-premerge-20091211, matt-nb5-mips64-k15, matt-nb5-mips64, matt-nb4-mips64-k7-u2a-k9b, matt-mips64-premerge-20101231, matt-mips64-base2, matt-mips64-base, matt-mips64, matt-armv6-prevmlocking, matt-armv6-nbase, matt-armv6-base, matt-armv6, keiichi-mipv6-base, keiichi-mipv6, jym-xensuspend-nbase, jym-xensuspend-base, jym-xensuspend, hpcarm-cleanup-nbase, hpcarm-cleanup-base, hpcarm-cleanup, cube-autoconf-base, cube-autoconf, christos-time_t-nbase, christos-time_t-base, christos-time_t, cherry-xenmp-base, cherry-xenmp, bouyer-quota2-nbase, bouyer-quota2-base, bouyer-quota2
Branch point for: yamt-pagecache
Changes since 1.25: +46 -28 lines

PR/36464: scandir(3) corrupts heap when run on ZFS directories because ZFS
returns the number of entries as the directory size.
Use a new, more conservative entries estimator.

/*	$NetBSD: scandir.c,v 1.26 2007/06/09 23:57:25 christos Exp $	*/

/*
 * Copyright (c) 1983, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/cdefs.h>
#if defined(LIBC_SCCS) && !defined(lint)
#if 0
static char sccsid[] = "@(#)scandir.c	8.3 (Berkeley) 1/2/94";
#else
__RCSID("$NetBSD: scandir.c,v 1.26 2007/06/09 23:57:25 christos Exp $");
#endif
#endif /* LIBC_SCCS and not lint */

/*
 * Scan the directory dirname calling selectfn to make a list of selected
 * directory entries then sort using qsort and compare routine dcomp.
 * Returns the number of entries and a pointer to a list of pointers to
 * struct dirent (through namelist). Returns -1 if there were any errors.
 */

#include "namespace.h"
#include <sys/types.h>
#include <sys/stat.h>

#include <assert.h>
#include <errno.h>
#include <dirent.h>
#include <stdlib.h>
#include <string.h>

/*
 * Compute an estimate of the number of entries in a directory based on
 * the file size. Returns the estimated number of entries or 0 on failure.
 */
static size_t
dirsize(int fd, size_t olen)
{
	struct stat stb;
	size_t nlen;

	if (fstat(fd, &stb) == -1)
		return 0;
	/*
	 * Estimate the array size by taking the size of the directory file
	 * and dividing it by a multiple of the minimum size entry. 
	 */
	nlen = (size_t)(stb.st_size / _DIRENT_MINSIZE((struct dirent *)0));
	/*
	 * If the size turns up 0, switch to an alternate strategy and use the
	 * file size as the number of entries like ZFS returns. If that turns
	 * out to be 0 too return a minimum of 10 entries, plus the old length.
	 */
	if (nlen == 0)
		nlen = (size_t)(stb.st_size ? stb.st_size : 10);
	return olen + nlen;
}

int
scandir(const char *dirname, struct dirent ***namelist,
    int (*selectfn)(const struct dirent *),
    int (*dcomp)(const void *, const void *))
{
	struct dirent *d, *p, **names, **newnames;
	size_t nitems, arraysz;
	DIR *dirp;

	_DIAGASSERT(dirname != NULL);
	_DIAGASSERT(namelist != NULL);

	if ((dirp = opendir(dirname)) == NULL)
		return -1;

	if ((arraysz = dirsize(dirp->dd_fd, 0)) == 0)
		goto bad;

	names = malloc(arraysz * sizeof(*names));
	if (names == NULL)
		goto bad;

	nitems = 0;
	while ((d = readdir(dirp)) != NULL) {
		if (selectfn != NULL && !(*selectfn)(d))
			continue;	/* just selected names */

		/*
		 * Check to make sure the array has space left and
		 * realloc the maximum size.
		 */
		if (nitems >= arraysz) {
			if ((arraysz = dirsize(dirp->dd_fd, arraysz)) == 0)
				goto bad2;
			newnames = realloc(names, arraysz * sizeof(*names));
			if (newnames == NULL)
				goto bad2;
			names = newnames;
		}

		/*
		 * Make a minimum size copy of the data
		 */
		p = malloc((size_t)_DIRENT_SIZE(d));
		if (p == NULL)
			goto bad2;
		p->d_fileno = d->d_fileno;
		p->d_reclen = d->d_reclen;
		p->d_type = d->d_type;
		p->d_namlen = d->d_namlen;
		(void)memmove(p->d_name, d->d_name, (size_t)(p->d_namlen + 1));
		names[nitems++] = p;
	}
	(void)closedir(dirp);
	if (nitems && dcomp != NULL)
		qsort(names, nitems, sizeof(*names), dcomp);
	*namelist = names;
	return nitems;

bad2:
	while (nitems-- > 0)
		free(names[nitems]);
	free(names);
bad:
	(void)closedir(dirp);
	return -1;
}