[9fans] Bug in ramfs.c

[9fans] Bug in ramfs.c

[Porlock]

[-- Attachment #1: Type: text/plain, Size: 961 bytes --]

There is a bug in ramfs which causes it to crash when the length of a
file is set to zero (using the wstat message).  To see this bug, the
attached utility to set the file length is helpful.

Having first saved setlength.c into a plan9 directory, the following
commands can be used to see the bug :-

% 8c setlength.c && 8l -o setlength setlength.8
% ramfs -m /n/junk
% echo something >/n/junk/test
% ./setlength /n/junk/test 0
setting length of /n/junk/test to 0
ramfs: out of memory:
./setlength: dirwstat failed: i/o on hungup channel
% unmount /n/junk

The fix for the bug seems to be the following :-

/sys/src/cmd/ramfs.c:880,886 - ramfs2.c:880,886
   erealloc(void *p, ulong n)
   {
   	p = realloc(p, n);
- 	if(!p)
+ 	if(n && !p)
   		error("out of memory");
   	return p;
   }


the point is that when n == 0, realloc(p, n) will always return null
(after first calling free(p)).  So a null p is only an error if n > 0.


[-- Attachment #2: setlength.c --]
[-- Type: text/x-csrc, Size: 604 bytes --]

#include <u.h>
#include <libc.h>

void main(int argc, char **argv)
{
    struct Dir st;
    int i, n;
    if (argc < 3) {
        fprint(2, "usage: %s file length\n", argv[0]);
        exits("usage");
    }
    n = atoi(argv[2]);
    if (n < 0) {
        fprint(2, "%s: invalid length\n", argv[0]);
        exits("usage");
    }
    nulldir(&st);
    st.length = n;
    print("setting length of %s to %d\n", argv[1], n);
    i = dirwstat(argv[1], &st);
    if (i < 0) {
        fprint(2, "%s: dirwstat failed: %r\n", argv[0]);
        exits("dirwstat");
    }
    exits(0);
}