[Unionfs] Fix for unionctl <file> --query command

[Marcelo Ricardo Leitner]

Hi all,

While doing some quick tests with unionfs here, I noticed that with the
following setup:

[root at localhost unionfs-test]# ll */oi
-rw-r--r-- 1 root root 4 2008-02-19 11:34 mount/oi
-rw-r--r-- 1 root root 3 2008-02-19 11:30 ro/oi
-rw-r--r-- 1 root root 4 2008-02-19 11:34 rw/oi
[root at localhost unionfs-test]# pwd
/tmp/unionfs-test
[root at localhost unionfs-test]# grep unionfs-test /proc/mounts
none /tmp/unionfs-test/mount unionfs
rw,dirs=/tmp/unionfs-test/rw=rw:/tmp/unionfs-test/ro=ro 0 0

unionctl --query didn't work if the file was present on both branches, like
the 'oi' file.
[root at localhost mount]# unionctl oi --query
Segmentation fault

Then I noticed that unionctl 0.2.1 did a step wrongly. There goes a patch,
which explains it better than any word I guess :)

--- unionfs_utils-0.2.1/ctl.c.old	2008-02-19 13:56:43.000000000 -0300
+++ unionfs_utils-0.2.1/ctl.c	2008-02-19 13:56:43.000000000 -0300
@@ -87,7 +87,7 @@ int unionfs_query(const char *file_path,
 		if (FD_ISSET(i, &branchlist)) {
 			*ufs_branches = realloc(*ufs_branches,
 					sizeof(struct unionfs_branch)*(ret+1));
-			(*ufs_branches)[ret].path = malloc(strlen(branches[ret]+1));
+			(*ufs_branches)[ret].path = malloc(strlen(branches[i])+1);
 			strcpy((*ufs_branches)[ret].path, branches[i]);
 			(*ufs_branches)[ret].perms = branchperms[i];
 			ret++;

2 bugs on that line:
a) branches[] got indexed by two different variables, differently
controlled. malloc used 'ret' index while strcpy used 'i' index.
b) the '+1' for counting the null-byte should be outside strlen(pointer),
otherwise we will have a 2 bytes offset. This may be worst on chrooted
systems, which would make it malloc(0) bytes.

What do you think?

Please, Cc me as currently I'm not subscribed to the list.
Thanks,
Marcelo.