[RTEMS Project] #2375: tftpDriver free's current_directory

[RTEMS trac]

#2375: tftpDriver free's current_directory
-------------------------+---------------------
 Reporter:  mdavidsaver  |       Owner:
     Type:  defect       |      Status:  new
 Priority:  normal       |   Milestone:  4.10.3
Component:  networking   |     Version:  4.10
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+---------------------

Comment (by mdavidsaver):

 I've created a test program to demonstrate the problem.  It can be run in
 QEMU with the pc386 BSP.

 https://github.com/mdavidsaver/rtems-tftp-test

 I've also made an attempt to backport the changes to tftpDriver.c from the
 master/4.11 branches.  However, this was not enough to fix the issue.
 With an additional fix the test program passes.

 https://github.com/mdavidsaver/rtems/commits/4.10-tftp-fix

 The 4 revisions on this branch are:

 === apply changes through master ===

 {{{#!sh
 git diff 4.10.2..eb7753437ff858ebe34a08baef7dfdb45eb0f018 --
 cpukit/libnetworking/lib/tftpDriver.c | git apply
 }}}

 The was later rebase'd onto the 4.10 branch head.

 === backport fixes ===

 Undo some post 4.10 changes to make it build.
 Use ->node_access_2 to hold the path string owned by location_info struct.
 So node_access_2==NULL implies that node_access is a borrowed reference.
 This is used in eval_path to ensure that all node_access for the FS root
 share the same string (otherwise unmount() complains).

 === close() false error ===

 It seems that close() returns -1 on success (errno==0).  A bug, but
 unrelated to my original report.

 === don't free directory node's path string ===

 Use of realloc() in eval_path still allows several location_info s to
 unwittingly share the same string.  Since the length of the string isn't
 tracked, the parent node's path is silently changed.  This patch fixes the
 reported issue.

--
Ticket URL: <http://devel.rtems.org/ticket/2375#comment:2>
RTEMS Project <http://www.rtems.org/>
RTEMS Project