From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 24605 invoked by alias); 28 Aug 2008 12:54:25 -0000 Received: (qmail 24592 invoked by alias); 28 Aug 2008 12:54:25 -0000 X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL,BAYES_00,J_CHICKENPOX_24,J_CHICKENPOX_63,J_CHICKENPOX_65,J_CHICKENPOX_73,KAM_MX,SPF_HELO_PASS X-Spam-Check-By: sourceware.org X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on bastion.fedora.phx.redhat.com X-Spam-Level: Subject: master - ccs: deal with xml file format special case To: cluster-cvs-relay@redhat.com X-Project: Cluster Project X-Git-Module: cluster.git X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Oldrev: aeda124b395dd5ad7a115b934a7d1ed8a6ca17c7 X-Git-Newrev: e80d71336fac784e0412a49c0d15fda90111b876 From: "Fabio M. Di Nitto" Message-Id: <20080828125315.080AC120379@lists.fedorahosted.org> Date: Thu, 28 Aug 2008 12:57:00 -0000 X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254 Mailing-List: contact cluster-cvs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: cluster-cvs-owner@sourceware.org X-SW-Source: 2008-q3/txt/msg00347.txt.bz2 Gitweb: http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=e80d71336fac784e0412a49c0d15fda90111b876 Commit: e80d71336fac784e0412a49c0d15fda90111b876 Parent: aeda124b395dd5ad7a115b934a7d1ed8a6ca17c7 Author: Fabio M. Di Nitto AuthorDate: Thu Aug 28 14:45:57 2008 +0200 Committer: Fabio M. Di Nitto CommitterDate: Thu Aug 28 14:45:57 2008 +0200 ccs: deal with xml file format special case when talking about specific xpath queries, writing: .. is not the same as writing: fix memory overflow in both ccsd and xmlconfig. It is impossible to exploit this overflow for anything useful since it's used at the very beginning of the startup process when literally nothing is running and it causes the XML parser to crash. ccsd did never show this issue because it was using a pre-allocated buffer and it was always big enough to hold the data (even when we were writing more than our calculated size). xml on the other side, always need to allocate. Signed-off-by: Fabio M. Di Nitto --- config/daemons/ccsd/cnx_mgr.c | 20 +++++++++++++------- config/plugins/xml/config.c | 18 ++++++++++++------ 2 files changed, 25 insertions(+), 13 deletions(-) diff --git a/config/daemons/ccsd/cnx_mgr.c b/config/daemons/ccsd/cnx_mgr.c index 0dfa1cd..fddd834 100644 --- a/config/daemons/ccsd/cnx_mgr.c +++ b/config/daemons/ccsd/cnx_mgr.c @@ -857,7 +857,7 @@ static int _process_get(comm_header_t *ch, char **payload){ if(obj->nodesetval && (obj->nodesetval->nodeNr > 0) ){ xmlNodePtr node; int size=0; - int nnv=0; /* name 'n' value */ + int nnv=0, child=0; /* name 'n' value */ if(ocs[desc]->oc_index >= obj->nodesetval->nodeNr){ ocs[desc]->oc_index = 0; @@ -881,10 +881,11 @@ static int _process_get(comm_header_t *ch, char **payload){ ((node->type == XML_ELEMENT_NODE) && strstr(query, "child::*"))){ /* add on the trailing NULL and the '=' separator for a list of attrs or an element node + CDATA*/ - if (node->children && node->children->content) + if (node->children && node->children->content) { size = strlen((char *)node->children->content) + strlen((char *)node->name)+2; - else + child = 1; + } else size = strlen((char *)node->name)+2; nnv= 1; } else { @@ -899,8 +900,10 @@ static int _process_get(comm_header_t *ch, char **payload){ if(size <= ch->comm_payload_size){ /* do we already have enough space? */ log_printf(LOG_DEBUG, "No extra space needed.\n"); if(nnv){ - sprintf(*payload, "%s=%s", node->name, node->children ? - (char *)node->children->content:""); + if(child) + sprintf(*payload, "%s=%s", node->name, (char *)node->children->content); + else + sprintf(*payload, "%s=", node->name); } else { sprintf(*payload, "%s", node->children ? node->children->content : node->name); @@ -914,9 +917,12 @@ static int _process_get(comm_header_t *ch, char **payload){ error = -ENOMEM; goto fail; } + memset(*payload,0,size); if(nnv){ - sprintf(*payload, "%s=%s", node->name, node->children ? - (char *)node->children->content:""); + if(child) + sprintf(*payload, "%s=%s", node->name, (char *)node->children->content); + else + sprintf(*payload, "%s=", node->name); } else { sprintf(*payload, "%s", node->children ? node->children->content : node->name); diff --git a/config/plugins/xml/config.c b/config/plugins/xml/config.c index 8771007..9d59772 100644 --- a/config/plugins/xml/config.c +++ b/config/plugins/xml/config.c @@ -58,7 +58,7 @@ static char *do_xml_query(xmlXPathContextPtr ctx, char *query, int list) { xmlXPathObjectPtr obj = NULL; xmlNodePtr node = NULL; char *rtn = NULL; - int size = 0, nnv = 0; + int size = 0, nnv = 0, child = 0; if (list && !strcmp(query, previous_query)) xmllistindex++; @@ -81,10 +81,11 @@ static char *do_xml_query(xmlXPathContextPtr ctx, char *query, int list) { if (((node->type == XML_ATTRIBUTE_NODE) && strstr(query, "@*")) || ((node->type == XML_ELEMENT_NODE) && strstr(query, "child::*"))) { - if (node->children && node->children->content) + if (node->children && node->children->content) { size = strlen((char *)node->children->content) + strlen((char *)node->name)+2; - else + child = 1; + } else size = strlen((char *)node->name)+2; nnv = 1; @@ -99,9 +100,14 @@ static char *do_xml_query(xmlXPathContextPtr ctx, char *query, int list) { if (!rtn) goto fail; - if (nnv) - sprintf(rtn, "%s=%s", node->name, node->children ? (char *)node->children->content:""); - else + memset(rtn, 0, size); + + if (nnv) { + if (child) + sprintf(rtn, "%s=%s", node->name, (char *)node->children->content); + else + sprintf(rtn, "%s=", node->name); + } else sprintf(rtn, "%s", node->children ? node->children->content : node->name); if(list)