Fix Linux client extended attribute handling

uroni · Dec 31, 2016 · 0cf004f · 0cf004f
1 parent 27bcd5d
commit 0cf004f
Show file tree

Hide file tree

Showing 3 changed files with 38 additions and 7 deletions.
diff --git a/fileservplugin/FileMetadataPipe.cpp b/fileservplugin/FileMetadataPipe.cpp
@@ -27,6 +27,7 @@
 #include "FileServ.h"
 #include "PipeSessions.h"
 #include "../common/adler32.h"
+#include <limits.h>
 
 #ifndef _WIN32
 #include <sys/types.h>
@@ -990,14 +991,23 @@ namespace
 				return false;
 			}
 
-			TokenizeMail(buf, keys, "\0");
+			TokenizeMail(buf, keys, std::string(1, '\0'));
 
-            for(size_t i=0;i<keys.size();++i)
+            for(size_t i=0;i<keys.size();)
             {
-                unsigned int ksize = keys[i].size();
+				if (keys[i].empty()
+					|| keys[i].size()>=MAX_UINT)
+				{
+					keys.erase(keys.begin() + i);
+					continue;
+				}
+
+                unsigned int ksize = static_cast<unsigned int>(keys[i].size());
                 ksize = little_endian(ksize);
 
                 keys[i].insert(0, reinterpret_cast<char*>(&ksize), sizeof(ksize));
+
+				++i;
             }
 
 			return true;
@@ -1013,7 +1023,7 @@ namespace
 
 			if(bufsize==-1)
 			{
-				Server->Log("Error getting extended attribute "+key+" of file "+fn+" errno: "+convert(errno), LL_ERROR);
+				Server->Log("Error getting extended attribute \""+key+"\" of file \""+fn+"\" errno: "+convert(errno), LL_ERROR);
 				return false;
 			}
 
@@ -1029,7 +1039,7 @@ namespace
 
 			if(bufsize==-1)
 			{
-				Server->Log("Error getting extended attribute list of file "+fn+" errno: "+convert(errno)+" (2)", LL_ERROR);
+				Server->Log("Error getting extended attribute \""+key+"\" of file \""+fn+"\" errno: "+convert(errno)+" (2)", LL_ERROR);
 				return false;
 			}
 
@@ -1158,7 +1168,9 @@ bool FileMetadataPipe::transmitCurrMetadata(char* buf, size_t buf_avail, size_t&
 		{			
             if(!get_xattr(local_fn, eattr_keys[eattr_idx], eattr_val))
 			{
-				return false;
+				eattr_val.resize(sizeof(_u32));
+				unsigned int umax = MAX_UINT;
+				memcpy(&eattr_val[0], &umax, sizeof(umax));
 			}
 			backup_state = BackupState_EAttr_Vals_Val;
 			eattr_val_off=0;

diff --git a/stringtools.cpp b/stringtools.cpp
@@ -592,7 +592,7 @@ void TokenizeMail(const std::string& str, std::vector<std::string> &tokens, std:
 	while(true)
 	{ 
 		// find the next seperator
-		pos1 = (s32)str.find_first_of(seps.c_str(), pos0);
+		pos1 = (s32)str.find_first_of(seps, pos0);
 		// find the next \" 
 
 		// if the end is reached..

diff --git a/urbackupserver/FileMetadataDownloadThread.cpp b/urbackupserver/FileMetadataDownloadThread.cpp
@@ -1179,6 +1179,13 @@ bool FileMetadataDownloadThread::applyUnixMetadata(IFile* metadata_f, IFile* out
         metadata_size+=sizeof(key_size);
         key_size = little_endian(key_size);
 
+		if (key_size > 1 * 1024 * 1024)
+		{
+			ServerLogger::Log(logid, "Eattry key "+convert(i)+" for  \"" + (output_f != NULL ? output_f->getFilename() : "NONE") + "\" too large with size " + PrettyPrintBytes(key_size)
+				+ " in \"" + metadata_f->getFilename() + "\"", LL_ERROR);
+			return false;
+		}
+
         std::string eattr_key;
         eattr_key.resize(key_size);
 
@@ -1218,6 +1225,18 @@ bool FileMetadataDownloadThread::applyUnixMetadata(IFile* metadata_f, IFile* out
         metadata_size+=sizeof(val_size);
         val_size = little_endian(val_size);
 
+		if (val_size == UINT_MAX)
+		{
+			continue;
+		}
+
+		if (val_size > 10 * 1024 * 1024)
+		{
+			ServerLogger::Log(logid, "Eattry value for eattr \""+eattr_key+"\" for \""+ (output_f!=NULL ? output_f->getFilename(): "NONE")+"\" too large with size "+PrettyPrintBytes(val_size)
+				+" in \"" + metadata_f->getFilename() + "\"", LL_ERROR);
+			return false;
+		}
+
         std::string eattr_val;
         eattr_val.resize(val_size);