jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-18 06:50:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

STABLE149-avoid-buffer-overflow-on-rx-fixed-size-array-return-20090402

Browse Source 
LICENSE IPL10
FIXES 124579

avoid potentially writing beyond allocated memory if a return is larger than exp
ected


(cherry picked from commit 62bca1123f)
This commit is contained in:
Simon Wilkinson 2009-04-07 03:56:59 +00:00 committed by Derrick Brashear
parent b8531aae9c
commit 370a05ddf9
2 changed files with 24 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/afs/VNOPS/afs_vnop_lookup.c
View File

@ -538,8 +538,6 @@ afs_DoBulkStat(struct vcache *adp, long dirCookie, struct vrequest *areqp)
int nskip; /* # of slots in the LRU queue to skip */
struct vcache *lruvcp; /* vcache ptr of our goal pos in LRU queue */
struct dcache *dcp; /* chunk containing the dir block */
char *statMemp; /* status memory block */
char *cbfMemp; /* callback and fid memory block */
afs_size_t temp; /* temp for holding chunk length, &c. */
struct AFSFid *fidsp; /* file IDs were collecting */
struct AFSCallBack *cbsp; /* call back pointers */
@ -597,13 +595,11 @@ afs_DoBulkStat(struct vcache *adp, long dirCookie, struct vrequest *areqp)
* one for fids and callbacks, and one for stat info. Well set
* up our pointers to the memory from there, too.
*/
statMemp = osi_AllocLargeSpace(nentries * sizeof(AFSFetchStatus));
statsp = (struct AFSFetchStatus *)statMemp;
cbfMemp =
osi_AllocLargeSpace(nentries *
(sizeof(AFSCallBack) + sizeof(AFSFid)));
fidsp = (AFSFid *) cbfMemp;
cbsp = (AFSCallBack *) (cbfMemp + nentries * sizeof(AFSFid));
statsp = (AFSFetchStatus *)
osi_Alloc(AFSCBMAX * sizeof(AFSFetchStatus));
fidsp = (AFSFid *) osi_AllocLargeSpace(nentries * sizeof(AFSFid));
cbsp = (AFSCallBack *)
osi_Alloc(AFSCBMAX * sizeof(AFSCallBack));
/* next, we must iterate over the directory, starting from the specified
* cookie offset (dirCookie), and counting out nentries file entries.
@ -1091,8 +1087,9 @@ afs_DoBulkStat(struct vcache *adp, long dirCookie, struct vrequest *areqp)
code = 0;
}
done2:
osi_FreeLargeSpace(statMemp);
osi_FreeLargeSpace(cbfMemp);
osi_FreeLargeSpace((char *)fidsp);
osi_Free((char *)statsp, AFSCBMAX * sizeof(AFSFetchStatus));
osi_Free((char *)cbsp, AFSCBMAX * sizeof(AFSCallBack));
return code;
}

19
src/sys/rmtsysc.c
View File

@ -241,8 +241,14 @@ pioctl(char *path, afs_int32 cmd, struct ViceIoctl *data, afs_int32 follow)
InData.rmtbulk_len = data->in_size;
InData.rmtbulk_val = inbuffer;
inparam_conversion(cmd, InData.rmtbulk_val, 0);
OutData.rmtbulk_len = data->out_size;
OutData.rmtbulk_val = data->out;
OutData.rmtbulk_len = MAXBUFFERLEN * sizeof(*OutData.rmtbulk_val);
OutData.rmtbulk_val = malloc(OutData.rmtbulk_len);
if (!OutData.rmtbulk_val) {
free(inbuffer);
return -1;
}
/* We always need to pass absolute pathnames to the remote pioctl since we
* lose the current directory value when doing an rpc call. Below we
* prepend the current absolute path directory, if the name is relative */
@ -279,8 +285,15 @@ pioctl(char *path, afs_int32 cmd, struct ViceIoctl *data, afs_int32 follow)
if (!errorcode) {
/* Do the conversions back to the host order; store the results back
* on the same buffer */
outparam_conversion(cmd, OutData.rmtbulk_val, 1);
if (data->out_size < OutData.rmtbulk_len) {
errno = EINVAL;
errorcode = -1;
} else {
memcpy(data->out, OutData.rmtbulk_val, data->out_size);
outparam_conversion(cmd, data->out, 1);
}
}
free(OutData.rmtbulk_val);
free(inbuffer);
return errorcode;
}