소스 검색

Don't access invalid mem in totemconfig interfaces

When ringnumber in config file was set to value bigger or equal to
INTERFACE_MAX, we are using this big value as index to totemconfig
interfaces array, resulting to access to invalid memory and segfault.

Instead of that, ringnumber is now checked and proper error message is
printed if value is too big.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
(cherry picked from commit 373ded06523246ea634aec9e19bafb10932067a9)
Jan Friesse 13 년 전
부모
커밋
d3b476be39
1개의 변경된 파일10개의 추가작업 그리고 0개의 파일을 삭제
  1. 10 0
      exec/totemconfig.c

+ 10 - 0
exec/totemconfig.c

@@ -502,6 +502,16 @@ extern int totem_config_read (
 		member_count = 0;
 		member_count = 0;
 
 
 		ringnumber = atoi(ringnumber_key);
 		ringnumber = atoi(ringnumber_key);
+
+		if (ringnumber >= INTERFACE_MAX) {
+			snprintf (error_string_response, sizeof(error_string_response),
+			    "parse error in config: interface ring number %u is bigger then allowed maximum %u\n",
+			    ringnumber, INTERFACE_MAX - 1);
+
+			*error_string = error_string_response;
+			return -1;
+		}
+
 		/*
 		/*
 		 * Get the bind net address
 		 * Get the bind net address
 		 */
 		 */