From 80ebd3a25ae7dcfcaebec58d7a80b919e2eed5ee Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Sun, 14 Dec 2014 21:33:17 +0100 Subject: changelog: Unchecked buffer fill in gf_history_changelog_next_change A gf_history_changelog_next_change() calls gf_readline() to fill a buffer without checking buffer size. The size of maxlen is not verified to be less than the lenght of buffer. This could result in the over filling of buffer of maxlen is greater than PATH_MAX. Check the size of maxlen to be less than PATH_MAX and return a fail code as needed. BUG: 1174017 Change-Id: Ic53b1a6e25af69a339bc15fb2d233dc1e457910f Reported-by: Keith Schincke Signed-off-by: Niels de Vos Reviewed-on: http://review.gluster.org/9275 Tested-by: Gluster Build System Reviewed-by: Venky Shankar Tested-by: Venky Shankar --- xlators/features/changelog/lib/src/gf-changelog.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'xlators') diff --git a/xlators/features/changelog/lib/src/gf-changelog.c b/xlators/features/changelog/lib/src/gf-changelog.c index 18eeac3e1a4..fb2d9037ffb 100644 --- a/xlators/features/changelog/lib/src/gf-changelog.c +++ b/xlators/features/changelog/lib/src/gf-changelog.c @@ -336,6 +336,11 @@ gf_changelog_next_change (char *bufptr, size_t maxlen) gf_changelog_t *gfc = NULL; char buffer[PATH_MAX] = {0,}; + if (maxlen > PATH_MAX) { + errno = ENAMETOOLONG; + goto out; + } + errno = EINVAL; this = THIS; -- cgit