CVE-2021-44142-snippet-2.c

/* 4264 */ static ssize_t fruit_pread_meta_adouble(vfs_handle_struct *handle,
/* 4265 */                     files_struct *fsp, void *data,
/* 4266 */                     size_t n, off_t offset)
/* 4267 */ {
/* 4268 */     AfpInfo *ai = NULL;
/* 4269 */     struct adouble *ad = NULL;
/* 4270 */     char afpinfo_buf[AFP_INFO_SIZE];
/* 4271 */     char *p = NULL;
/* 4272 */     ssize_t nread;
/* 4273 */ 
/* 4274 */     ai = afpinfo_new(talloc_tos());
/* 4275 */     if (ai == NULL) {
/* 4276 */         return -1;
/* 4277 */     }
/* 4278 */ 
/* 4279 */     ad = `ad_fget(talloc_tos(), handle, fsp, ADOUBLE_META);   // <-- create `adouble` struct
/* 4280 */     if (ad == NULL) {
/* 4281 */         nread = -1;
/* 4282 */         goto fail;
/* 4283 */     }
/* 4284 */ 
/* 4285 */     p = ad_get_entry(ad, ADEID_FINDERI);                     // <-- p = ad->data + ad->ad_eid[ADEID_FINDERI].ade_off
/* 4286 */     if (p == NULL) {
/* 4287 */         DBG_ERR("No ADEID_FINDERI for [%s]\n", fsp_str_dbg(fsp));
/* 4288 */         nread = -1;
/* 4289 */         goto fail;
/* 4290 */     }
/* 4291 */ 
/* 4292 */     memcpy(&ai->afpi_FinderInfo[0], p, ADEDLEN_FINDERI);    // <-- read 32 bytes from buffer `p`
/* 4293 */ 
/* 4294 */     nread = afpinfo_pack(ai, afpinfo_buf);
/* 4295 */     if (nread != AFP_INFO_SIZE) {
/* 4296 */         nread = -1;
/* 4297 */         goto fail;
/* 4298 */     }
/* 4299 */ 
/* 4300 */     memcpy(data, afpinfo_buf, n);                            // <-- copy to out buffer, it will be sent back to user later
/* 4301 */     nread = n;
/* 4302 */ 
/* 4303 */ fail:
/* 4304 */     TALLOC_FREE(ai);
/* 4305 */     return nread;
/* 4306 */ }