andy/glusterfs
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

feature/changelog: Fix buffer overflow crash

Browse Source 
The buffer used to hold the basename  was hard coded
to the size of NAME_MAX(255). It might lead to buffer
overflow crashes when the basename which is sent
is more than NAME_MAX length. Fixed the same.

Change-Id: I6c1cad3ccaeb8c55549b1d3c5f96a198f65ba2b7
BUG: 1463178
Signed-off-by: Kotresh HR <khiremat@redhat.com>
Reviewed-on: https://review.gluster.org/17579
CentOS-regression: Gluster Build System <jenkins@build.gluster.org>
NetBSD-regression: NetBSD Build System <jenkins@build.gluster.org>
Smoke: Gluster Build System <jenkins@build.gluster.org>
Reviewed-by: jiffin tony Thottan <jthottan@redhat.com>
This commit is contained in:
Kotresh HR 2017-06-20 06:26:18 -04:00 committed by Aravinda VK
parent 3183ca1bde
commit b224f4253b
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
xlators/features/changelog/src/changelog.c
View File

@ -222,8 +222,8 @@ changelog_unlink (call_frame_t *frame, xlator_t *this,
gf_boolean_t barrier_enabled = _gf_false;
dht_changelog_rename_info_t *info = NULL;
int ret = 0;
char old_name[NAME_MAX] = {0};
char new_name[NAME_MAX] = {0};
char *old_name = NULL;
char *new_name = NULL;
char *nname = NULL;
INIT_LIST_HEAD (&queue);
@ -234,6 +234,8 @@ changelog_unlink (call_frame_t *frame, xlator_t *this,
ret = dict_get_bin (xdata, DHT_CHANGELOG_RENAME_OP_KEY, (void **)&info);
if (!ret) { /* special case: unlink considered as rename */
/* 3 == fop + oldloc + newloc */
old_name = alloca (info->oldname_len);
new_name = alloca (info->newname_len);
CHANGELOG_INIT_NOCHECK (this, frame->local,
NULL, loc->inode->gfid, 3);