浏览代码

Don't access invalid mem in totemconfig

When ringnumber in config file was set to value bigger or equal to
INTERFACE_MAX, we are using this big value as index to totemconfig
interfaces array, resulting to access to invalid memory and segfault.

Instead of that, ringnumber is now checked and proper error message is
printed if value is too big.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
Jan Friesse 13 年之前
父节点
当前提交
539917e35a
共有 1 个文件被更改,包括 10 次插入0 次删除
  1. 10 0
      exec/totemconfig.c

+ 10 - 0
exec/totemconfig.c

@@ -364,6 +364,16 @@ printf ("couldn't find totem handle\n");
 
 		objdb_get_int (objdb, object_interface_handle, "ringnumber", &ringnumber);
 
+
+		if (ringnumber >= INTERFACE_MAX) {
+			snprintf (error_string_response, sizeof(error_string_response),
+			    "parse error in config: interface ring number %u is bigger then allowed maximum %u\n",
+			    ringnumber, INTERFACE_MAX - 1);
+
+			*error_string = error_string_response;
+			return -1;
+		}
+
 		/*
 		 * Get interface multicast address
 		 */