master - ccs: deal with xml file format special case

master - ccs: deal with xml file format special case

[Fabio M. Di Nitto]

Gitweb:        http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=e80d71336fac784e0412a49c0d15fda90111b876
Commit:        e80d71336fac784e0412a49c0d15fda90111b876
Parent:        aeda124b395dd5ad7a115b934a7d1ed8a6ca17c7
Author:        Fabio M. Di Nitto <fdinitto@redhat.com>
AuthorDate:    Thu Aug 28 14:45:57 2008 +0200
Committer:     Fabio M. Di Nitto <fdinitto@redhat.com>
CommitterDate: Thu Aug 28 14:45:57 2008 +0200

ccs: deal with xml file format special case

when talking about specific xpath queries, writing:
<clusternode name="node4" votes="1" nodeid="4"><fence>..

is not the same as writing:
<clusternode name="node4" votes="1" nodeid="4">
 <fence>

fix memory overflow in both ccsd and xmlconfig. It is impossible to
exploit this overflow for anything useful since it's used at the very
beginning of the  startup process when literally nothing is running
and it causes the XML parser to crash.

ccsd did never show this issue because it was using a pre-allocated
buffer and it was always big enough to hold the data (even when we were
writing more than our calculated size).

xml on the other side, always need to allocate.

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
---
 config/daemons/ccsd/cnx_mgr.c |   20 +++++++++++++-------
 config/plugins/xml/config.c   |   18 ++++++++++++------
 2 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/config/daemons/ccsd/cnx_mgr.c b/config/daemons/ccsd/cnx_mgr.c
index 0dfa1cd..fddd834 100644
--- a/config/daemons/ccsd/cnx_mgr.c
+++ b/config/daemons/ccsd/cnx_mgr.c
@@ -857,7 +857,7 @@ static int _process_get(comm_header_t *ch, char **payload){
     if(obj->nodesetval && (obj->nodesetval->nodeNr > 0) ){
       xmlNodePtr node;
       int size=0;
-      int nnv=0; /* name 'n' value */
+      int nnv=0, child=0; /* name 'n' value */
 
       if(ocs[desc]->oc_index >= obj->nodesetval->nodeNr){
 	ocs[desc]->oc_index = 0;
@@ -881,10 +881,11 @@ static int _process_get(comm_header_t *ch, char **payload){
 	 ((node->type == XML_ELEMENT_NODE) && strstr(query, "child::*"))){
 	/* add on the trailing NULL and the '=' separator for a list of attrs
 	   or an element node + CDATA*/
- 	if (node->children && node->children->content)
+ 	if (node->children && node->children->content) {
  	  size = strlen((char *)node->children->content) +
 		 strlen((char *)node->name)+2;
- 	else 
+	  child = 1;
+ 	} else 
  	  size = strlen((char *)node->name)+2;
 	nnv= 1;
       } else {
@@ -899,8 +900,10 @@ static int _process_get(comm_header_t *ch, char **payload){
       if(size <= ch->comm_payload_size){  /* do we already have enough space? */
 	log_printf(LOG_DEBUG, "No extra space needed.\n");
 	if(nnv){
- 	  sprintf(*payload, "%s=%s", node->name, node->children ?
- 					 (char *)node->children->content:"");
+	  if(child)
+ 	    sprintf(*payload, "%s=%s", node->name, (char *)node->children->content);
+	  else
+	    sprintf(*payload, "%s=", node->name);
 	} else {
  	  sprintf(*payload, "%s", node->children ? node->children->content :
  				  node->name);
@@ -914,9 +917,12 @@ static int _process_get(comm_header_t *ch, char **payload){
 	  error = -ENOMEM;
 	  goto fail;
 	}
+	memset(*payload,0,size);
 	if(nnv){
- 	  sprintf(*payload, "%s=%s", node->name, node->children ?
- 					 (char *)node->children->content:"");
+	  if(child)
+ 	    sprintf(*payload, "%s=%s", node->name, (char *)node->children->content);
+	  else
+	    sprintf(*payload, "%s=", node->name);
 	} else {
  	  sprintf(*payload, "%s", node->children ? node->children->content :
  				  node->name);
diff --git a/config/plugins/xml/config.c b/config/plugins/xml/config.c
index 8771007..9d59772 100644
--- a/config/plugins/xml/config.c
+++ b/config/plugins/xml/config.c
@@ -58,7 +58,7 @@ static char *do_xml_query(xmlXPathContextPtr ctx, char *query, int list) {
 	xmlXPathObjectPtr obj = NULL;
 	xmlNodePtr node = NULL;
 	char *rtn = NULL;
-	int size = 0, nnv = 0;
+	int size = 0, nnv = 0, child = 0;
 
 	if (list && !strcmp(query, previous_query))
 		xmllistindex++;
@@ -81,10 +81,11 @@ static char *do_xml_query(xmlXPathContextPtr ctx, char *query, int list) {
 
 		if (((node->type == XML_ATTRIBUTE_NODE) && strstr(query, "@*")) ||
 		     ((node->type == XML_ELEMENT_NODE) && strstr(query, "child::*"))) {
-			if (node->children && node->children->content)
+			if (node->children && node->children->content) {
 				size = strlen((char *)node->children->content) +
 					strlen((char *)node->name)+2;
-			else
+				child = 1;
+			} else
 				size = strlen((char *)node->name)+2;
 
 			nnv = 1;
@@ -99,9 +100,14 @@ static char *do_xml_query(xmlXPathContextPtr ctx, char *query, int list) {
 		if (!rtn)
 			goto fail;
 
-		if (nnv)
-			sprintf(rtn, "%s=%s", node->name, node->children ? (char *)node->children->content:"");
-		else
+		memset(rtn, 0, size);
+
+		if (nnv) {
+			if (child)
+				sprintf(rtn, "%s=%s", node->name, (char *)node->children->content);
+			else
+				sprintf(rtn, "%s=", node->name);
+		} else
 			sprintf(rtn, "%s", node->children ? node->children->content : node->name);
 
 		if(list)