From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 28241 invoked by alias); 28 Aug 2008 12:57:55 -0000 Received: (qmail 28234 invoked by alias); 28 Aug 2008 12:57:55 -0000 X-Spam-Status: No, hits=-0.5 required=5.0 tests=AWL,BAYES_00,J_CHICKENPOX_24,J_CHICKENPOX_65,KAM_MX,SPF_HELO_PASS X-Spam-Check-By: sourceware.org X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on bastion.fedora.phx.redhat.com X-Spam-Level: Subject: STABLE2 - ccs: deal with xml file format special case To: cluster-cvs-relay@redhat.com X-Project: Cluster Project X-Git-Module: cluster.git X-Git-Refname: refs/heads/STABLE2 X-Git-Reftype: branch X-Git-Oldrev: e4b12524d8b99edff1fac8c6680aa4fd047dec9f X-Git-Newrev: e7ccca48f51ad98c3e0420fed25b742377890bac From: "Fabio M. Di Nitto" Message-Id: <20080828125652.EA4D5120379@lists.fedorahosted.org> Date: Thu, 28 Aug 2008 13:49:00 -0000 X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254 Mailing-List: contact cluster-cvs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: cluster-cvs-owner@sourceware.org X-SW-Source: 2008-q3/txt/msg00348.txt.bz2 Gitweb: http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=e7ccca48f51ad98c3e0420fed25b742377890bac Commit: e7ccca48f51ad98c3e0420fed25b742377890bac Parent: e4b12524d8b99edff1fac8c6680aa4fd047dec9f Author: Fabio M. Di Nitto AuthorDate: Thu Aug 28 14:45:57 2008 +0200 Committer: Fabio M. Di Nitto CommitterDate: Thu Aug 28 14:56:08 2008 +0200 ccs: deal with xml file format special case when talking about specific xpath queries, writing: .. is not the same as writing: fix possible memory overflow in ccsd. It is impossible to exploit this overflow for anything useful since it's used at the very beginning of the startup process when literally nothing is running and it causes the XML parser to crash. ccsd did never show this issue because it was using a pre-allocated buffer and it was always big enough to hold the data (even when we were writing more than our calculated size). Signed-off-by: Fabio M. Di Nitto --- ccs/daemon/cnx_mgr.c | 20 +++++++++++++------- 1 files changed, 13 insertions(+), 7 deletions(-) diff --git a/ccs/daemon/cnx_mgr.c b/ccs/daemon/cnx_mgr.c index 5fcaaa0..e2def86 100644 --- a/ccs/daemon/cnx_mgr.c +++ b/ccs/daemon/cnx_mgr.c @@ -855,7 +855,7 @@ static int _process_get(comm_header_t *ch, char **payload){ if(obj->nodesetval && (obj->nodesetval->nodeNr > 0) ){ xmlNodePtr node; int size=0; - int nnv=0; /* name 'n' value */ + int nnv=0, child=0; /* name 'n' value */ if(ocs[desc]->oc_index >= obj->nodesetval->nodeNr){ ocs[desc]->oc_index = 0; @@ -879,10 +879,11 @@ static int _process_get(comm_header_t *ch, char **payload){ ((node->type == XML_ELEMENT_NODE) && strstr(query, "child::*"))){ /* add on the trailing NULL and the '=' separator for a list of attrs or an element node + CDATA*/ - if (node->children && node->children->content) + if (node->children && node->children->content) { size = strlen((char *)node->children->content) + strlen((char *)node->name)+2; - else + child = 1; + } else size = strlen((char *)node->name)+2; nnv= 1; } else { @@ -897,8 +898,10 @@ static int _process_get(comm_header_t *ch, char **payload){ if(size <= ch->comm_payload_size){ /* do we already have enough space? */ log_dbg("No extra space needed.\n"); if(nnv){ - sprintf(*payload, "%s=%s", node->name, node->children ? - (char *)node->children->content:""); + if(child) + sprintf(*payload, "%s=%s", node->name, (char *)node->children->content); + else + sprintf(*payload, "%s=", node->name); } else { sprintf(*payload, "%s", node->children ? node->children->content : node->name); @@ -912,9 +915,12 @@ static int _process_get(comm_header_t *ch, char **payload){ error = -ENOMEM; goto fail; } + memset(*payload,0,size); if(nnv){ - sprintf(*payload, "%s=%s", node->name, node->children ? - (char *)node->children->content:""); + if(child) + sprintf(*payload, "%s=%s", node->name, (char *)node->children->content); + else + sprintf(*payload, "%s=", node->name); } else { sprintf(*payload, "%s", node->children ? node->children->content : node->name);