瀏覽代碼

totemconfig: Check length of rrp_mode string

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
Jan Friesse 13 年之前
父節點
當前提交
421de34972
共有 1 個文件被更改,包括 6 次插入0 次删除
  1. 6 0
      exec/totemconfig.c

+ 6 - 0
exec/totemconfig.c

@@ -467,6 +467,12 @@ extern int totem_config_read (
 	}
 
 	if (icmap_get_string("totem.rrp_mode", &str) == CS_OK) {
+		if (strlen(str) >= TOTEM_RRP_MODE_BYTES) {
+			*error_string = "totem.rrp_mode is too long";
+			free(str);
+
+			return -1;
+		}
 		strcpy (totem_config->rrp_mode, str);
 		free(str);
 	}