CVE-2021-44142-snippet-3.c

/* 4642 */ static ssize_t fruit_pwrite_meta_netatalk(vfs_handle_struct *handle,
/* 4643 */                       files_struct *fsp, const void *data,
/* 4644 */                       size_t n, off_t offset)
/* 4645 */ {
/* 4646 */     struct adouble *ad = NULL;
/* 4647 */     AfpInfo *ai = NULL;
/* 4648 */     char *p = NULL;
/* 4649 */     int ret;
/* 4650 */     bool ok;
/* 4651 */
/* 4652 */     ai = afpinfo_unpack(talloc_tos(), data);
/* 4653 */     if (ai == NULL) {
/* 4654 */         return -1;
/* 4655 */     }
/* 4656 */
/* 4657 */     ad = ad_fget(talloc_tos(), handle, fsp, ADOUBLE_META);     // <-- create `adouble` struct
/* 4658 */     if (ad == NULL) {
/* 4659 */         ad = ad_init(talloc_tos(), handle, ADOUBLE_META);
/* 4660 */         if (ad == NULL) {
/* 4661 */             return -1;
/* 4662 */         }
/* 4663 */     }
/* 4664 */     p = ad_get_entry(ad, ADEID_FINDERI);                       // <-- p = ad->data + ad->ad_eid[ADEID_FINDERI].ade_off
/* 4665 */     if (p == NULL) {
/* 4666 */         DBG_ERR("No ADEID_FINDERI for [%s]\n", fsp_str_dbg(fsp));
/* 4667 */         TALLOC_FREE(ad);
/* 4668 */         return -1;
/* 4669 */     }
/* 4670 */
/* 4671 */     memcpy(p, &ai->afpi_FinderInfo[0], ADEDLEN_FINDERI);       // <-- write 32 bytes to buffer `p`
/* 4672 */
/* ...  */              
/* 4704 */ }