proxmox-mirrors/mirror_corosync
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_corosync synced 2026-08-16 13:05:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

cmap: Check input param name_t length

Browse Source 
IPC is using buffer of CS_MAX_NAME_LENGTH for name. If user calls
function with longer string, such string can be passed to service
incomplete.

Solution is to not allow string larger then CS_MAX_NAME_LENGTH (what is
same as ICMAP_KEYNAME_MAXLEN) and return error.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
This commit is contained in:
Jan Friesse 2012-08-08 15:43:49 +02:00
parent 7c43647172
commit fefdc2db87
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/cmap.c
View File

@ -361,6 +361,10 @@ cs_error_t cmap_set (
return (CS_ERR_INVALID_PARAM);
}
if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
return (CS_ERR_NAME_TOO_LONG);
}
error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
if (error != CS_OK) {
return (error);
@ -468,6 +472,9 @@ cs_error_t cmap_delete(cmap_handle_t handle, const char *key_name)
if (key_name == NULL) {
return (CS_ERR_INVALID_PARAM);
}
if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
return (CS_ERR_NAME_TOO_LONG);
}
error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
if (error != CS_OK) {
@ -517,6 +524,9 @@ cs_error_t cmap_get(
if (key_name == NULL) {
return (CS_ERR_INVALID_PARAM);
}
if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
return (CS_ERR_NAME_TOO_LONG);
}
error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
if (error != CS_OK) {
@ -714,6 +724,9 @@ static cs_error_t cmap_adjust_int(cmap_handle_t handle, const char *key_name, in
if (key_name == NULL) {
return (CS_ERR_INVALID_PARAM);
}
if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
return (CS_ERR_NAME_TOO_LONG);
}
error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
if (error != CS_OK) {
@ -781,6 +794,9 @@ cs_error_t cmap_iter_init(
req_lib_cmap_iter_init.header.id = MESSAGE_REQ_CMAP_ITER_INIT;
if (prefix) {
if (strlen(prefix) >= CS_MAX_NAME_LENGTH) {
return (CS_ERR_NAME_TOO_LONG);
}
memcpy(req_lib_cmap_iter_init.prefix.value, prefix, strlen(prefix));
req_lib_cmap_iter_init.prefix.length = strlen(prefix);
}
@ -943,6 +959,9 @@ cs_error_t cmap_track_add(
req_lib_cmap_track_add.header.id = MESSAGE_REQ_CMAP_TRACK_ADD;
if (key_name) {
if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
return (CS_ERR_NAME_TOO_LONG);
}
memcpy(req_lib_cmap_track_add.key_name.value, key_name, strlen(key_name));
req_lib_cmap_track_add.key_name.length = strlen(key_name);
}