diff --git a/libatalk/vfs/ea_ad.c b/libatalk/vfs/ea_ad.c index 6b67a2cab4e..6b79bbaa454 100644 --- a/libatalk/vfs/ea_ad.c +++ b/libatalk/vfs/ea_ad.c @@ -127,7 +127,6 @@ static int unpack_header(struct ea * restrict ea) uint16_t uint16; uint32_t uint32; char *buf; - size_t remaining; /* Check magic and version */ buf = ea->ea_data; @@ -155,15 +154,6 @@ static int unpack_header(struct ea * restrict ea) if (ea->ea_count == 0) return 0; - /* Check magic and version */ - buf = ea->ea_data; - remaining = ea->ea_size; - - if (remaining < EA_HEADER_SIZE) { - ret = -1; - goto exit; - } - /* Allocate storage for the ea_entries array */ ea->ea_entries = malloc(sizeof(struct ea_entry) * ea->ea_count); if ( ! ea->ea_entries) { @@ -172,35 +162,19 @@ static int unpack_header(struct ea * restrict ea) goto exit; } + buf = ea->ea_data + EA_HEADER_SIZE; while (count < ea->ea_count) { - /* Check if we have enough bytes for EA size (4) + at least 1 char for name */ - if (remaining < 5) { - ret = -1; - goto cleanup; - } - memcpy(&uint32, buf, 4); /* EA size */ buf += 4; - remaining -= 4; - - /* Validate string length fits in remaining buffer */ - size_t namelen = strnlen(buf, remaining); - if (namelen == remaining) { /* No null terminator found */ - ret = -1; - goto cleanup; - } - - /* Rest of the existing code */ (*(ea->ea_entries))[count].ea_size = ntohl(uint32); (*(ea->ea_entries))[count].ea_name = strdup(buf); if (! (*(ea->ea_entries))[count].ea_name) { + LOG(log_error, logtype_afpd, "unpack_header: OOM"); ret = -1; - goto cleanup; + goto exit; } - - (*(ea->ea_entries))[count].ea_namelen = namelen; - buf += namelen + 1; - remaining -= namelen + 1; + (*(ea->ea_entries))[count].ea_namelen = strlen((*(ea->ea_entries))[count].ea_name); + buf += (*(ea->ea_entries))[count].ea_namelen + 1; LOG(log_maxdebug, logtype_afpd, "unpack_header: entry no:%u,\"%s\", size: %u, namelen: %u", count, (*(ea->ea_entries))[count].ea_name, @@ -210,14 +184,6 @@ static int unpack_header(struct ea * restrict ea) count++; } -cleanup: - while (count > 0) { - count--; - free((*(ea->ea_entries))[count].ea_name); - } - free(ea->ea_entries); - ea->ea_entries = NULL; - exit: return ret; }