فهرست منبع

cmap: Check input param name_t length

IPC is using buffer of CS_MAX_NAME_LENGTH for name. If user calls
function with longer string, such string can be passed to service
incomplete.

Solution is to not allow string larger then CS_MAX_NAME_LENGTH (what is
same as ICMAP_KEYNAME_MAXLEN) and return error.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
Jan Friesse 13 سال پیش
والد
کامیت
fefdc2db87
1فایلهای تغییر یافته به همراه19 افزوده شده و 0 حذف شده
  1. 19 0
      lib/cmap.c

+ 19 - 0
lib/cmap.c

@@ -361,6 +361,10 @@ cs_error_t cmap_set (
 		return (CS_ERR_INVALID_PARAM);
 		return (CS_ERR_INVALID_PARAM);
 	}
 	}
 
 
+	if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
+		return (CS_ERR_NAME_TOO_LONG);
+	}
+
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	if (error != CS_OK) {
 	if (error != CS_OK) {
 		return (error);
 		return (error);
@@ -468,6 +472,9 @@ cs_error_t cmap_delete(cmap_handle_t handle, const char *key_name)
 	if (key_name == NULL) {
 	if (key_name == NULL) {
 		return (CS_ERR_INVALID_PARAM);
 		return (CS_ERR_INVALID_PARAM);
 	}
 	}
+	if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
+		return (CS_ERR_NAME_TOO_LONG);
+	}
 
 
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	if (error != CS_OK) {
 	if (error != CS_OK) {
@@ -517,6 +524,9 @@ cs_error_t cmap_get(
 	if (key_name == NULL) {
 	if (key_name == NULL) {
 		return (CS_ERR_INVALID_PARAM);
 		return (CS_ERR_INVALID_PARAM);
 	}
 	}
+	if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
+		return (CS_ERR_NAME_TOO_LONG);
+	}
 
 
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	if (error != CS_OK) {
 	if (error != CS_OK) {
@@ -714,6 +724,9 @@ static cs_error_t cmap_adjust_int(cmap_handle_t handle, const char *key_name, in
 	if (key_name == NULL) {
 	if (key_name == NULL) {
 		return (CS_ERR_INVALID_PARAM);
 		return (CS_ERR_INVALID_PARAM);
 	}
 	}
+	if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
+		return (CS_ERR_NAME_TOO_LONG);
+	}
 
 
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	error = hdb_error_to_cs(hdb_handle_get (&cmap_handle_t_db, handle, (void *)&cmap_inst));
 	if (error != CS_OK) {
 	if (error != CS_OK) {
@@ -781,6 +794,9 @@ cs_error_t cmap_iter_init(
 	req_lib_cmap_iter_init.header.id = MESSAGE_REQ_CMAP_ITER_INIT;
 	req_lib_cmap_iter_init.header.id = MESSAGE_REQ_CMAP_ITER_INIT;
 
 
 	if (prefix) {
 	if (prefix) {
+		if (strlen(prefix) >= CS_MAX_NAME_LENGTH) {
+			return (CS_ERR_NAME_TOO_LONG);
+		}
 		memcpy(req_lib_cmap_iter_init.prefix.value, prefix, strlen(prefix));
 		memcpy(req_lib_cmap_iter_init.prefix.value, prefix, strlen(prefix));
 		req_lib_cmap_iter_init.prefix.length = strlen(prefix);
 		req_lib_cmap_iter_init.prefix.length = strlen(prefix);
 	}
 	}
@@ -943,6 +959,9 @@ cs_error_t cmap_track_add(
 	req_lib_cmap_track_add.header.id = MESSAGE_REQ_CMAP_TRACK_ADD;
 	req_lib_cmap_track_add.header.id = MESSAGE_REQ_CMAP_TRACK_ADD;
 
 
 	if (key_name) {
 	if (key_name) {
+		if (strlen(key_name) >= CS_MAX_NAME_LENGTH) {
+			return (CS_ERR_NAME_TOO_LONG);
+		}
 		memcpy(req_lib_cmap_track_add.key_name.value, key_name, strlen(key_name));
 		memcpy(req_lib_cmap_track_add.key_name.value, key_name, strlen(key_name));
 		req_lib_cmap_track_add.key_name.length = strlen(key_name);
 		req_lib_cmap_track_add.key_name.length = strlen(key_name);
 	}
 	}