io: Fix ftw internal realloc buffer (BZ #28126)

The 106ff08526d3ca did not take in consideration the buffer might be
reallocated if the total path is larger than PATH_MAX.  The realloc
uses 'dirbuf', where 'dirstreams' is the allocated buffer.

Checked on x86_64-linux-gnu.

Reviewed-by: H.J. Lu <hjl.tools@gmail.com>

1 files changed, 19 insertions, 20 deletions

diff --git a/io/ftw.c b/io/ftw.c
index f0db173727..fe953454f2 100644
--- a/io/ftw.c
+++ b/io/ftw.c
@@ -203,6 +203,20 @@ struct ftw_data
   void *known_objects;
 };
 
+static bool
+ftw_allocate (struct ftw_data *data, size_t newsize)
+{
+  void *newp = realloc (data->dirstreams, data->maxdir
+					  * sizeof (struct dir_data *)
+					  + newsize);
+  if (newp == NULL)
+    return false;
+  data->dirstreams = newp;
+  data->dirbufsize = newsize;
+  data->dirbuf = (char *) data->dirstreams
+		 + data->maxdir * sizeof (struct dir_data *);
+  return true;
+}
 
 /* Internally we use the FTW_* constants used for `nftw'.  When invoked
    as `ftw', map each flag to the subset of values used by `ftw'.  */
@@ -388,17 +402,9 @@ process_entry (struct ftw_data *data, struct dir_data *dir, const char *name,
     return 0;
 
   new_buflen = data->ftw.base + namlen + 2;
-  if (data->dirbufsize < new_buflen)
-    {
-      /* Enlarge the buffer.  */
-      char *newp;
-
-      data->dirbufsize = 2 * new_buflen;
-      newp = (char *) realloc (data->dirbuf, data->dirbufsize);
-      if (newp == NULL)
-	return -1;
-      data->dirbuf = newp;
-    }
+  if (data->dirbufsize < new_buflen
+      && !ftw_allocate (data, 2 * new_buflen))
+    return -1;
 
   *((char *) __mempcpy (data->dirbuf + data->ftw.base, name, namlen)) = '\0';
 
@@ -628,7 +634,7 @@ __attribute ((noinline))
 ftw_startup (const char *dir, int is_nftw, void *func, int descriptors,
 	     int flags)
 {
-  struct ftw_data data;
+  struct ftw_data data = { .dirstreams = NULL };
   struct STRUCT_STAT st;
   int result = 0;
   int save_err;
@@ -646,16 +652,9 @@ ftw_startup (const char *dir, int is_nftw, void *func, int descriptors,
   data.maxdir = descriptors < 1 ? 1 : descriptors;
   data.actdir = 0;
   /* PATH_MAX is always defined when we get here.  */
-  data.dirbufsize = MAX (2 * strlen (dir), PATH_MAX);
-  data.dirstreams = malloc (data.maxdir * sizeof (struct dir_data *)
-                            + data.dirbufsize);
-  if (data.dirstreams == NULL)
+  if (!ftw_allocate (&data, MAX (2 * strlen (dir), PATH_MAX)))
     return -1;
-
   memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data *));
-
-  data.dirbuf = (char *) data.dirstreams
-                + data.maxdir * sizeof (struct dir_data *);
   cp = __stpcpy (data.dirbuf, dir);
   /* Strip trailing slashes.  */
   while (cp > data.dirbuf + 1 && cp[-1] == '/')