1 files changed, 26 insertions, 19 deletions

diff --git a/sysdeps/unix/sysv/linux/getdents.c b/sysdeps/unix/sysv/linux/getdents.c
index 40b31617ef..b4b12d48eb 100644
--- a/sysdeps/unix/sysv/linux/getdents.c
+++ b/sysdeps/unix/sysv/linux/getdents.c
@@ -49,11 +49,11 @@ struct kernel_dirent
 
 /* The problem here is that we cannot simply read the next NBYTES
    bytes.  We need to take the additional field into account.  We use
-   some heuristic.  Assume the directory contains names with at least
-   3 characters we can compute a maximum number of entries which fit
-   in the buffer.  Taking this number allows us to specify a correct
-   number of bytes to read.  If we should be wrong, we can reset the
-   file descriptor.  */
+   some heuristic.  Assuming the directory contains names with 14
+   characters on average we can compute an estimate number of entries
+   which fit in the buffer.  Taking this number allows us to specify a
+   correct number of bytes to read.  If we should be wrong, we can reset
+   the file descriptor.  */
 ssize_t
 __getdirentries (fd, buf, nbytes, basep)
      int fd;
@@ -62,12 +62,16 @@ __getdirentries (fd, buf, nbytes, basep)
      off_t *basep;
 {
   off_t base = __lseek (fd, (off_t) 0, SEEK_CUR);
+  off_t last_offset = base;
   size_t red_nbytes;
   struct kernel_dirent *skdp, *kdp;
   struct dirent *dp;
   int retval;
+  const size_t size_diff = (offsetof (struct dirent, d_name)
+			    - offsetof (struct kernel_dirent, d_name));
 
-  red_nbytes = nbytes - (nbytes / (offsetof (struct dirent, d_name) + 3));
+  red_nbytes = nbytes - ((nbytes / (offsetof (struct dirent, d_name) + 14))
+			 * size_diff);
 
   dp = (struct dirent *) buf;
   skdp = kdp = __alloca (red_nbytes);
@@ -76,26 +80,29 @@ __getdirentries (fd, buf, nbytes, basep)
 
   while ((char *) kdp < (char *) skdp + retval)
     {
-      const size_t size_diff = MAX (offsetof (struct dirent, d_name)
-				    - offsetof (struct kernel_dirent, d_name),
-				    __alignof__ (struct dirent));
+      const size_t alignment = __alignof__ (struct dirent);
+      /* Since kdp->d_reclen is already aligned for the kernel structure
+	 this may compute a value that is bigger than necessary.  */
+      size_t new_reclen = ((kdp->d_reclen + size_diff + alignment - 1)
+			   & ~(alignment - 1));
+      if ((char *) dp + new_reclen > buf + nbytes)
+	{
+	  /* Our heuristic failed.  We read too many entries.  Reset
+	     the stream.  */
+	  __lseek (fd, last_offset, SEEK_SET);
+	  break;
+	}
+
+      last_offset = kdp->d_off;
       dp->d_ino = kdp->d_ino;
       dp->d_off = kdp->d_off;
-      dp->d_reclen = kdp->d_reclen + size_diff;
+      dp->d_reclen = new_reclen;
       dp->d_type = DT_UNKNOWN;
       memcpy (dp->d_name, kdp->d_name,
 	      kdp->d_reclen - offsetof (struct kernel_dirent, d_name));
 
-      dp = (struct dirent *) (((char *) dp) + dp->d_reclen);
+      dp = (struct dirent *) ((char *) dp + new_reclen);
       kdp = (struct kernel_dirent *) (((char *) kdp) + kdp->d_reclen);
-
-      if ((char *) dp >= buf + nbytes)
-	{
-	  /* Our heuristic failed.  We read too many entries.  Reset
-	     the stream.  */
-	  off_t used = ((char *) kdp - (char *) buf) - (nbytes - red_nbytes);
-	  base = __lseek (fd, retval - used, SEEK_CUR);
-	}
     }
 
   if (basep)