[comp.os.minix] Gross bug in fs/open.c

ast@cs.vu.nl (Andy Tanenbaum) (06/28/90)

Thanks to Martin Patzel of Germany for pointing out this truly gross bug.
That MINIX ever worked is close to a miracle.

Andy Tanenbaum (ast@cs.vu.nl)

echo x - open.cdif
sed '/^X/s///' > open.cdif << '/'
X*** open.c	Sat May  5 13:14:25 1990
X--- open.new	Wed Jun 27 23:56:54 1990
X***************
X*** 55,61 ****
X    if (fetch_name(name1, name1_length, M1) != OK) return(err_code);
X    bits = (mode & I_TYPE) | (mode & ALL_MODES & fp->fp_umask);
X    size = (unsigned int) name2;
X!   put_inode(new_node(user_path, bits, (zone_nr) addr), (off_t)size*BLOCK_SIZE);
X    return(err_code);
X  }
X  
X--- 55,61 ----
X    if (fetch_name(name1, name1_length, M1) != OK) return(err_code);
X    bits = (mode & I_TYPE) | (mode & ALL_MODES & fp->fp_umask);
X    size = (unsigned int) name2;
X!   put_inode(new_node(user_path, bits, (zone_nr) addr, (off_t)size*BLOCK_SIZE));
X    return(err_code);
X  }
X  
/

ghelmer@dsuvax.uucp (Guy Helmer) (06/28/90)

This looks like a fairly important fix.  From a casual perusal of the
code, how did a file's length ever get set correctly?  Function
new_node in open.c would have been putting junk in the i_size field
of every inode for every new file.



-- 
Guy Helmer                             ...!bigtex!loft386!dsuvax!ghelmer
DSU Computing Services         ghelmer@dsuvax.uucp,  helmer@sdnet.bitnet
           Small is beautiful, but looks aren't everything...

croes@fwi.uva.nl (Felix A. Croes) (07/01/90)

In article <1990Jun28.153540.2584@dsuvax.uucp> ghelmer@dsuvax.uucp (Guy Helmer) writes:
>This looks like a fairly important fix.  From a casual perusal of the
>code, how did a file's length ever get set correctly?  Function
>new_node in open.c would have been putting junk in the i_size field
>of every inode for every new file.

It is not really a miracle, but a coincidence. First, the last argument is put
on the stack, intended as an argument for put_inode. Then, the arguments for
new_node are evaluated and pushed. So new_node finds the arguments on the
stack exactly in the way they should be - only, according to the way it is
invoced, it should not know about or make use of the last argument.
Put_inode will expect only one argument, and ignore any others.

If my assumption is correct, this fix should not result in any change in the
minix.img output.

--

Felix Croes    (croes@fwi.uva.nl)