search

EtiennePerot / fuse-jna

No-nonsense, actually-working Java bindings to FUSE using JNA.
http://fusejna.net/
Other
137 stars 43 forks source link

Incorrect mapping of bitfields in StructFuseFileInfo #16

Closed daizaku closed 11 years ago

daizaku commented 11 years ago

Certain flags in StructFuseFileInfo were mapped as individual variables when they should have been mapped as bitfields.

This is a serious bug that results in:

  1. Memory beyond the allocated fuse struct being accessed and modified, potentially leading to a buffer overflow exploit.
  2. Making it difficult to utilize any of these flags
  3. Making it impossible to created file-handle based file systems, as the fh variable comes after this variable.

The source in fuse_common.h is specified as follows:

unsigned int direct_io : 1; unsigned int keep_cache : 1; unsigned int flush : 1; unsigned int nonseekable : 1; unsigned int flock_release : 1; unsigned int padding : 27;

This change will fix this issue by making these flags as bitfields. Unfortunately, there isn't a clean way to do this mapping in JNA, so bitmask operations are used on a 32bit integer to accomplish this.

EtiennePerot commented 11 years ago

Oh wow, this could explain quite a few obscure errors that I was seeing in some cases... Thanks a lot for this.