Memory overflow caused by 'basedir regex', bug #567

Authored-by: Takao Shimayoshi
Reviewed-by: Ralph Boehme <rb@sernet.de>

diff --git a/NEWS b/NEWS
index b42830e86110e36b098de9c876647c8c5f5252e8..f305674be90e77d4f5480d0c6b1bcdf0d308890c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ Changes in 3.1.3
        attributes" and "spotlight expr"
 * FIX: afpd: Unarchiving certain ZIP archives fails, bug #569
 * UPD: Update Unicode support to version 7.0.0
+* FIX: Memory overflow caused by 'basedir regex', bug #567
 
 Changes in 3.1.2
 ================

diff --git a/libatalk/util/netatalk_conf.c b/libatalk/util/netatalk_conf.c
index 71acf8841adf263e68f15a290b228da2cae89e42..32bda78ab9fd4786fcd34276ab466ec22fc2b71d 100644 (file)
--- a/libatalk/util/netatalk_conf.c
+++ b/libatalk/util/netatalk_conf.c
@@ -1682,7 +1682,7 @@ struct vol *getvolbypath(AFPObj *obj, const char *path)
     strlcat(tmpbuf, "/", MAXPATHLEN);
 
     /* (5) */
-    p = path + strlen(basedir);
+    p = path + match[0].rm_eo - match[0].rm_so;
     while (*p == '/')
         p++;
     EC_NULL_LOG( user = strdup(p) );