Просмотр исходного кода

votequorum: Assert copied strings length

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
(cherry picked from commit 35c312f810738faa2965bc8771528198b966ef39)
Jan Friesse 6 лет назад
Родитель
Сommit
16ecf4e141
1 измененных файлов с 6 добавлено и 0 удалено
  1. 6 0
      exec/votequorum.c

+ 6 - 0
exec/votequorum.c

@@ -1707,7 +1707,11 @@ static int votequorum_exec_send_qdevice_reconfigure(const char *oldname, const c
 
 	req_exec_quorum_qdevice_reconfigure.header.id = SERVICE_ID_MAKE(VOTEQUORUM_SERVICE, MESSAGE_REQ_EXEC_VOTEQUORUM_QDEVICE_RECONFIGURE);
 	req_exec_quorum_qdevice_reconfigure.header.size = sizeof(req_exec_quorum_qdevice_reconfigure);
+
+	assert(strlen(oldname) < sizeof(req_exec_quorum_qdevice_reconfigure.oldname));
 	strcpy(req_exec_quorum_qdevice_reconfigure.oldname, oldname);
+
+	assert(strlen(newname) < sizeof(req_exec_quorum_qdevice_reconfigure.newname));
 	strcpy(req_exec_quorum_qdevice_reconfigure.newname, newname);
 
 	iov[0].iov_base = (void *)&req_exec_quorum_qdevice_reconfigure;
@@ -1730,6 +1734,8 @@ static int votequorum_exec_send_qdevice_reg(uint32_t operation, const char *qdev
 	req_exec_quorum_qdevice_reg.header.id = SERVICE_ID_MAKE(VOTEQUORUM_SERVICE, MESSAGE_REQ_EXEC_VOTEQUORUM_QDEVICE_REG);
 	req_exec_quorum_qdevice_reg.header.size = sizeof(req_exec_quorum_qdevice_reg);
 	req_exec_quorum_qdevice_reg.operation = operation;
+
+	assert(strlen(qdevice_name_req) < sizeof(req_exec_quorum_qdevice_reg.qdevice_name));
 	strcpy(req_exec_quorum_qdevice_reg.qdevice_name, qdevice_name_req);
 
 	iov[0].iov_base = (void *)&req_exec_quorum_qdevice_reg;