diff options
| author | shishir gowda <shishirng@gluster.com> | 2010-08-05 01:50:28 +0000 |
|---|---|---|
| committer | Anand V. Avati <avati@dev.gluster.com> | 2010-08-06 03:37:51 -0700 |
| commit | 624eefdeaa82419307f7e91ceaea58183d2ebe10 (patch) | |
| tree | 46edc223c5873ccc8b20d4e171d2517a5afbf87d /xlators | |
| parent | 9dca1bc7822a71fbefb4ca161281884cdf31129b (diff) | |
Fix for seg fault in dict_unserialize if undersized buffers are passed
Signed-off-by: shishir gowda <shishirng@gluster.com>
Signed-off-by: Anand V. Avati <avati@dev.gluster.com>
BUG: 1031 (dict_unserialize crash if undersized buffers passed)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=1031
Diffstat (limited to 'xlators')
| -rw-r--r-- | xlators/protocol/server/src/server-protocol.c | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/xlators/protocol/server/src/server-protocol.c b/xlators/protocol/server/src/server-protocol.c index c4b0d47c83f..0cfdf0095cf 100644 --- a/xlators/protocol/server/src/server-protocol.c +++ b/xlators/protocol/server/src/server-protocol.c @@ -6206,6 +6206,7 @@ static call_frame_t * get_frame_for_call (transport_t *trans, gf_hdr_common_t *hdr) { call_frame_t *frame = NULL; + int32_t ret = -1; frame = get_frame_for_transport (trans); @@ -6217,7 +6218,12 @@ get_frame_for_call (transport_t *trans, gf_hdr_common_t *hdr) frame->root->gid = ntoh32 (hdr->req.gid); frame->root->pid = ntoh32 (hdr->req.pid); frame->root->lk_owner = ntoh64 (hdr->req.lk_owner); - server_decode_groups (frame, hdr); + ret = server_decode_groups (frame, hdr); + + if (ret) { + //FRAME_DESTROY (frame); + return NULL; + } return frame; } @@ -6337,6 +6343,10 @@ protocol_server_interpret (xlator_t *this, transport_t *trans, break; } frame = get_frame_for_call (trans, hdr); + if (!frame) { + ret = -1; + goto out; + } ret = gf_fops[op] (frame, bound_xl, hdr, hdrlen, iobuf); break; @@ -6348,6 +6358,10 @@ protocol_server_interpret (xlator_t *this, transport_t *trans, break; } frame = get_frame_for_call (trans, hdr); + if (!frame) { + ret = -1; + goto out; + } ret = gf_mops[op] (frame, bound_xl, hdr, hdrlen, iobuf); break; @@ -6365,13 +6379,17 @@ protocol_server_interpret (xlator_t *this, transport_t *trans, } frame = get_frame_for_call (trans, hdr); + if (!frame) { + ret = -1; + goto out; + } ret = gf_cbks[op] (frame, bound_xl, hdr, hdrlen, iobuf); break; default: break; } - +out: return ret; } |