coroipcc. h (coroipcc_dispatch_recv): Add a buflen parameter.

* lib/coroipcc.c (coroipcc_dispatch_recv): Update definition, and...
(memcpy_swrap): ... add a parameter here, too.
* include/corosync/coroipcc.h (coroipcc_dispatch_recv):
* lib/cfg.c (corosync_cfg_dispatch):
* lib/confdb.c (confdb_dispatch):
* lib/cpg.c (cpg_dispatch, cpg_flow_control_state_get):
* lib/evs.c (evs_dispatch):
* lib/quorum.c (quorum_dispatch):
* lib/votequorum.c (votequorum_dispatch):

git-svn-id: http://svn.fedorahosted.org/svn/corosync/trunk@1995 fd59a12c-fef9-0310-b244-a6a79926bd2f

include/corosync/coroipcc.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2002-2003 MontaVista Software, Inc.
- * Copyright (c) 2006-2007 Red Hat, Inc.
+ * Copyright (c) 2006-2007, 2009 Red Hat, Inc.
  *
  * All rights reserved.
  *
@@ -85,6 +85,7 @@ int
 coroipcc_dispatch_recv (
 	void *ipc_context,
 	void *buf,
+	size_t buflen,
 	int timeout);
 
 int

lib/cfg.c

@@ -195,7 +195,9 @@ corosync_cfg_dispatch (
 
 	do {
 		dispatch_avail = coroipcc_dispatch_recv (cfg_instance->ipc_ctx,
-			(void *)&dispatch_data, timeout);
+							 (void *)&dispatch_data,
+							 sizeof (dispatch_data),
+							 timeout);
 
 		/*
 		 * Handle has been finalized in another thread

lib/confdb.c

@@ -327,7 +327,9 @@ cs_error_t confdb_dispatch (
 		pthread_mutex_lock (&confdb_inst->dispatch_mutex);
 
 		dispatch_avail = coroipcc_dispatch_recv (confdb_inst->ipc_ctx,
-			(void *)&dispatch_data, timeout);
+							 (void *)&dispatch_data,
+							 sizeof (dispatch_data),
+							 timeout);
 
 
 		/*

lib/coroipcc.c

@@ -440,8 +440,8 @@ coroipcc_fd_get (void *ipc_ctx)
 	return (ipc_segment->fd);
 }
 
-static void memcpy_swrap (
-	void *dest, void *src, int len, unsigned int *read)
+static void memcpy_swrap (void *dest, size_t dest_len,
+			  void *src, int len, unsigned int *read)
 {
 	char *dest_chr = (char *)dest;
 	char *src_chr = (char *)src;
@@ -466,7 +466,7 @@ static void memcpy_swrap (
 int original_flow = -1;
 
 int
-coroipcc_dispatch_recv (void *ipc_ctx, void *data, int timeout)
+coroipcc_dispatch_recv (void *ipc_ctx, void *data, size_t buflen, int timeout)
 {
 	struct pollfd ufds;
 	struct sembuf sop;
@@ -546,23 +546,28 @@ retry_semop:
 	if (res == -1) {
 		return (-1);
 	}
-	
+
+	if (buflen < DISPATCH_SIZE) {
+		return -1;
+	}
+
 	if (ipc_segment->shared_memory->read + sizeof (mar_res_header_t) >= DISPATCH_SIZE) {
 		my_read = ipc_segment->shared_memory->read;
-		memcpy_swrap (data,
+		memcpy_swrap (data, DISPATCH_SIZE,
 			ipc_segment->shared_memory->dispatch_buffer,
 			sizeof (mar_res_header_t),
 			&ipc_segment->shared_memory->read);
 		header = (mar_res_header_t *)data;
 		memcpy_swrap (
 			(void *)((char *)data + sizeof (mar_res_header_t)),
+			DISPATCH_SIZE,
 			ipc_segment->shared_memory->dispatch_buffer,
 			header->size - sizeof (mar_res_header_t),
 			&ipc_segment->shared_memory->read);
 	} else {
 		header = (mar_res_header_t *)&ipc_segment->shared_memory->dispatch_buffer[ipc_segment->shared_memory->read];
 		memcpy_swrap (
-			data,
+			data, DISPATCH_SIZE,
 			ipc_segment->shared_memory->dispatch_buffer,
 			header->size,
 			&ipc_segment->shared_memory->read);

lib/cpg.c

@@ -266,7 +266,9 @@ cs_error_t cpg_dispatch (
 		pthread_mutex_lock (&cpg_inst->dispatch_mutex);
 
 		dispatch_avail = coroipcc_dispatch_recv (cpg_inst->ipc_ctx,
-			(void *)&dispatch_data, timeout);
+							 (void *)&dispatch_data,
+							 sizeof (dispatch_data),
+							 timeout);
 
 		pthread_mutex_unlock (&cpg_inst->dispatch_mutex);
 
@@ -647,7 +649,7 @@ cs_error_t cpg_flow_control_state_get (
 	if (error != CS_OK) {
 		return (error);
 	}
-	
+
 	*flow_control_state = coroipcc_dispatch_flow_control_get (cpg_inst->ipc_ctx);
 
 	saHandleInstancePut (&cpg_handle_t_db, handle);

lib/evs.c

@@ -2,7 +2,7 @@
  * vi: set autoindent tabstop=4 shiftwidth=4 :
 
  * Copyright (c) 2004-2005 MontaVista Software, Inc.
- * Copyright (c) 2006-2007 Red Hat, Inc.
+ * Copyright (c) 2006-2007, 2009 Red Hat, Inc.
  *
  * All rights reserved.
  *
@@ -222,7 +222,10 @@ evs_error_t evs_dispatch (
 	}
 
 	do {
-		dispatch_avail = coroipcc_dispatch_recv (evs_inst->ipc_ctx, (void *)&dispatch_data, timeout);
+		dispatch_avail = coroipcc_dispatch_recv (evs_inst->ipc_ctx,
+							 (void *)&dispatch_data,
+							 sizeof (dispatch_data),
+							 timeout);
 		if (dispatch_avail == -1) {
 			error = CS_ERR_LIBRARY;
 			goto error_nounlock;

lib/quorum.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Red Hat, Inc.
+ * Copyright (c) 2008, 2009 Red Hat, Inc.
  *
  * All rights reserved.
  *
@@ -392,7 +392,9 @@ cs_error_t quorum_dispatch (
 		pthread_mutex_lock (&quorum_inst->dispatch_mutex);
 
 		dispatch_avail = coroipcc_dispatch_recv (quorum_inst->ipc_ctx,
-			(void *)&dispatch_data, timeout);
+							 (void *)&dispatch_data,
+							 sizeof (dispatch_data),
+							 timeout);
 
 		/*
 		 * Handle has been finalized in another thread

lib/votequorum.c

@@ -776,10 +776,10 @@ cs_error_t votequorum_dispatch (
 	do {
 		pthread_mutex_lock (&votequorum_inst->dispatch_mutex);
 
-		dispatch_avail = coroipcc_dispatch_recv (
-			votequorum_inst->ipc_ctx,
-			(void *)&dispatch_data, timeout);
-
+		dispatch_avail = coroipcc_dispatch_recv (votequorum_inst->ipc_ctx,
+							 (void *)&dispatch_data,
+							 sizeof (dispatch_data),
+							 timeout);
 
 		/*
 		 * Handle has been finalized in another thread