Explorar o código

ipc: Check for the libraries sending invalid message IDs

If the library sent an invalid (ie too high) message ID to
corosync, then it could cause the daemon to crash.

Now we check the message ID before indexing the function array

Signed-off-by: Christine Caulfield <ccaulfie@redhat.com>
Reviewed-by: Jan Friesse <jfriesse@redhat.com>
Christine Caulfield %!s(int64=8) %!d(string=hai) anos
pai
achega
876910d8ff
Modificáronse 1 ficheiros con 5 adicións e 0 borrados
  1. 5 0
      exec/main.c

+ 5 - 0
exec/main.c

@@ -758,6 +758,11 @@ int corosync_sending_allowed (
 		return -EINVAL;
 		return -EINVAL;
 	}
 	}
 
 
+	/* Message ID out of range */
+	if (id >= corosync_service[service]->lib_engine_count) {
+		return -EINVAL;
+	}
+
 	sending_allowed = QB_FALSE;
 	sending_allowed = QB_FALSE;
 	if (corosync_quorum_is_quorate() == 1 ||
 	if (corosync_quorum_is_quorate() == 1 ||
 	    corosync_service[service]->allow_inquorate == CS_LIB_ALLOW_INQUORATE) {
 	    corosync_service[service]->allow_inquorate == CS_LIB_ALLOW_INQUORATE) {