STABLE2 - ccs: deal with xml file format special case

STABLE2 - ccs: deal with xml file format special case

[Fabio M. Di Nitto]

Gitweb:        http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=e7ccca48f51ad98c3e0420fed25b742377890bac
Commit:        e7ccca48f51ad98c3e0420fed25b742377890bac
Parent:        e4b12524d8b99edff1fac8c6680aa4fd047dec9f
Author:        Fabio M. Di Nitto <fdinitto@redhat.com>
AuthorDate:    Thu Aug 28 14:45:57 2008 +0200
Committer:     Fabio M. Di Nitto <fdinitto@redhat.com>
CommitterDate: Thu Aug 28 14:56:08 2008 +0200

ccs: deal with xml file format special case

when talking about specific xpath queries, writing:
<clusternode name="node4" votes="1" nodeid="4"><fence>..

is not the same as writing:
<clusternode name="node4" votes="1" nodeid="4">
 <fence>

fix possible memory overflow in ccsd. It is impossible to
exploit this overflow for anything useful since it's used at the very
beginning of the  startup process when literally nothing is running
and it causes the XML parser to crash.

ccsd did never show this issue because it was using a pre-allocated
buffer and it was always big enough to hold the data (even when we were
writing more than our calculated size).

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
---
 ccs/daemon/cnx_mgr.c |   20 +++++++++++++-------
 1 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/ccs/daemon/cnx_mgr.c b/ccs/daemon/cnx_mgr.c
index 5fcaaa0..e2def86 100644
--- a/ccs/daemon/cnx_mgr.c
+++ b/ccs/daemon/cnx_mgr.c
@@ -855,7 +855,7 @@ static int _process_get(comm_header_t *ch, char **payload){
     if(obj->nodesetval && (obj->nodesetval->nodeNr > 0) ){
       xmlNodePtr node;
       int size=0;
-      int nnv=0; /* name 'n' value */
+      int nnv=0, child=0; /* name 'n' value */
 
       if(ocs[desc]->oc_index >= obj->nodesetval->nodeNr){
 	ocs[desc]->oc_index = 0;
@@ -879,10 +879,11 @@ static int _process_get(comm_header_t *ch, char **payload){
 	 ((node->type == XML_ELEMENT_NODE) && strstr(query, "child::*"))){
 	/* add on the trailing NULL and the '=' separator for a list of attrs
 	   or an element node + CDATA*/
- 	if (node->children && node->children->content)
+ 	if (node->children && node->children->content) {
  	  size = strlen((char *)node->children->content) +
 		 strlen((char *)node->name)+2;
- 	else 
+	  child = 1;
+ 	} else 
  	  size = strlen((char *)node->name)+2;
 	nnv= 1;
       } else {
@@ -897,8 +898,10 @@ static int _process_get(comm_header_t *ch, char **payload){
       if(size <= ch->comm_payload_size){  /* do we already have enough space? */
 	log_dbg("No extra space needed.\n");
 	if(nnv){
- 	  sprintf(*payload, "%s=%s", node->name, node->children ?
- 					 (char *)node->children->content:"");
+	  if(child)
+ 	    sprintf(*payload, "%s=%s", node->name, (char *)node->children->content);
+	  else
+	    sprintf(*payload, "%s=", node->name);
 	} else {
  	  sprintf(*payload, "%s", node->children ? node->children->content :
  				  node->name);
@@ -912,9 +915,12 @@ static int _process_get(comm_header_t *ch, char **payload){
 	  error = -ENOMEM;
 	  goto fail;
 	}
+	memset(*payload,0,size);
 	if(nnv){
- 	  sprintf(*payload, "%s=%s", node->name, node->children ?
- 					 (char *)node->children->content:"");
+	  if(child)
+ 	    sprintf(*payload, "%s=%s", node->name, (char *)node->children->content);
+	  else
+	    sprintf(*payload, "%s=", node->name);
 	} else {
  	  sprintf(*payload, "%s", node->children ? node->children->content :
  				  node->name);