jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-22 17:00:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fs: fix setserverprefs where long is larger than afs_int32

Browse Source 
Make the fscanf and scanf format specifiers match the type of the
target variable.  This prevents trying to store a long int into an
afs_int32 variable which may be smaller, and overwriting neighbouring
data on the stack.

The effect on a 64-bit Linux system was that the high bits of "rank"
would overwrite the first 4 bytes of the scanned host name, causing
setserverprefs to fail with:
: couldn't resolve name.

Change-Id: I2100e7fe77a137257eb308ad127c151de84756bc
Reviewed-on: http://gerrit.openafs.org/5486
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Derrick Brashear <shadow@dementix.org>
Tested-by: Derrick Brashear <shadow@dementix.org>
This commit is contained in:
Marc Dionne 2011-09-21 20:31:33 -04:00 committed by Derrick Brashear
parent 6fb2e92422
commit 649d3a0957
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/venus/fs.c
View File

@ -3150,7 +3150,7 @@ SetPrefCmd(struct cmd_syndesc *as, void *arock)
afs_int32 code;
struct cmd_item *ti;
char name[80];
afs_int32 rank;
int rank;
struct setspref *ssp;
int error = 0; /* -1 means error message printed,
* >0 means errno value for unprinted message */
@ -3177,7 +3177,7 @@ SetPrefCmd(struct cmd_syndesc *as, void *arock)
perror(ti->data);
error = -1;
} else {
while (fscanf(infd, "%79s%ld", name, (long int *)&rank) != EOF) {
while (fscanf(infd, "%79s%d", name, &rank) != EOF) {
code = addServer(name, (unsigned short)rank);
if (code)
error = code;
@ -3187,7 +3187,7 @@ SetPrefCmd(struct cmd_syndesc *as, void *arock)
ti = as->parms[3].items; /* -stdin */
if (ti) {
while (scanf("%79s%ld", name, (long int *)&rank) != EOF) {
while (scanf("%79s%d", name, &rank) != EOF) {
code = addServer(name, (unsigned short)rank);
if (code)
error = code;