proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-05-30 22:25:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lib: limit size of vty buffer to 4096 bytes

Browse Source 
This removes the automatic resizing of the vty input buffer and places a
hard size cap of 4096 bytes. It also fixes a potentially unsafe strcpy.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
[cherry-picked from master 2af38873d8]
This commit is contained in:
Quentin Young 2017-01-10 23:33:50 +00:00 committed by David Lamparter
parent ccc4bd3062
commit 78af6edc6c
2 changed files with 53 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
lib/vty.c
View File

@ -508,18 +508,6 @@ vty_write (struct vty *vty, const char *buf, size_t nbytes)
buffer_put (vty->obuf, buf, nbytes); buffer_put (vty->obuf, buf, nbytes);
} }
/* Ensure length of input buffer. Is buffer is short, double it. */
static void
vty_ensure (struct vty *vty, int length)
{
if (vty->max <= length)
{
vty->max *= 2;
vty->buf = XREALLOC (MTYPE_VTY, vty->buf, vty->max);
vty->error_buf = XREALLOC (MTYPE_VTY, vty->error_buf, vty->max);
}
}
/* Basic function to insert character into vty. */ /* Basic function to insert character into vty. */
static void static void
vty_self_insert (struct vty *vty, char c) vty_self_insert (struct vty *vty, char c)
@ -527,7 +515,9 @@ vty_self_insert (struct vty *vty, char c)
int i; int i;
int length; int length;
vty_ensure (vty, vty->length + 1); if (vty->length + 1 > VTY_BUFSIZ)
return;
length = vty->length - vty->cp; length = vty->length - vty->cp;
memmove (&vty->buf[vty->cp + 1], &vty->buf[vty->cp], length); memmove (&vty->buf[vty->cp + 1], &vty->buf[vty->cp], length);
vty->buf[vty->cp] = c; vty->buf[vty->cp] = c;
@ -544,26 +534,29 @@ vty_self_insert (struct vty *vty, char c)
static void static void
vty_self_insert_overwrite (struct vty *vty, char c) vty_self_insert_overwrite (struct vty *vty, char c)
{ {
vty_ensure (vty, vty->length + 1); if (vty->cp == vty->length)
vty->buf[vty->cp++] = c; {
vty_self_insert (vty, c);
if (vty->cp > vty->length)
vty->length++;
if ((vty->node == AUTH_NODE) || (vty->node == AUTH_ENABLE_NODE))
return; return;
}
vty->buf[vty->cp++] = c;
vty_write (vty, &c, 1); vty_write (vty, &c, 1);
} }
/* Insert a word into vty interface with overwrite mode. */ /**
* Insert a string into vty->buf at the current cursor position.
*
* If the resultant string would be larger than VTY_BUFSIZ it is
* truncated to fit.
*/
static void static void
vty_insert_word_overwrite (struct vty *vty, char *str) vty_insert_word_overwrite (struct vty *vty, char *str)
{ {
int len = strlen (str); size_t nwrite = MIN ((int) strlen (str), VTY_BUFSIZ - vty->cp);
vty_write (vty, str, len); vty_write (vty, str, nwrite);
strcpy (&vty->buf[vty->cp], str); strncpy (&vty->buf[vty->cp], str, nwrite);
vty->cp += len; vty->cp += nwrite;
vty->length = vty->cp; vty->length = vty->cp;
} }
@ -2217,9 +2210,17 @@ vtysh_read (struct thread *thread)
printf ("line: %.*s\n", nbytes, buf); printf ("line: %.*s\n", nbytes, buf);
#endif /* VTYSH_DEBUG */ #endif /* VTYSH_DEBUG */
if (vty->length + nbytes > VTY_BUFSIZ)
{
/* Clear command line buffer. */
vty->cp = vty->length = 0;
vty_clear_buf (vty);
vty_out (vty, "%% Command is too long.%s", VTY_NEWLINE);
}
else
{
for (p = buf; p < buf+nbytes; p++) for (p = buf; p < buf+nbytes; p++)
{ {
vty_ensure(vty, vty->length+1);
vty->buf[vty->length++] = *p; vty->buf[vty->length++] = *p;
if (*p == '\0') if (*p == '\0')
{ {
@ -2240,7 +2241,7 @@ vtysh_read (struct thread *thread)
if (ret == CMD_SUSPEND) if (ret == CMD_SUSPEND)
break; break;
/* warning: watchfrr hardcodes this result write */ /* warning: watchquagga hardcodes this result write */
header[3] = ret; header[3] = ret;
buffer_put(vty->obuf, header, 4); buffer_put(vty->obuf, header, 4);
@ -2249,6 +2250,7 @@ vtysh_read (struct thread *thread)
return 0; return 0;
} }
} }
}
vty_event (VTYSH_READ, sock, vty); vty_event (VTYSH_READ, sock, vty);

2
lib/vty.h
View File

@ -26,7 +26,7 @@ Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
#include "sockunion.h" #include "sockunion.h"
#include "qobj.h" #include "qobj.h"
#define VTY_BUFSIZ 512 #define VTY_BUFSIZ 4096
#define VTY_MAXHIST 20 #define VTY_MAXHIST 20
#if defined(VTY_DEPRECATE_INDEX) && defined(__GNUC__) && \ #if defined(VTY_DEPRECATE_INDEX) && defined(__GNUC__) && \