fence-agents: master - fence_ipmilan: Possible buffer overflow

Marek GrĂ¡c marx at fedoraproject.org
Thu Jan 5 13:11:51 UTC 2012


Gitweb:        http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=60aae6b5f0ffea8c0e4f54aecf081c770ab4d67c
Commit:        60aae6b5f0ffea8c0e4f54aecf081c770ab4d67c
Parent:        f57d38bf7f4d26d9696ad95a485ac7883df2a23c
Author:        Marek 'marx' Grac <mgrac at redhat.com>
AuthorDate:    Thu Jan 5 14:08:42 2012 +0100
Committer:     Marek 'marx' Grac <mgrac at redhat.com>
CommitterDate: Thu Jan 5 14:08:42 2012 +0100

fence_ipmilan: Possible buffer overflow

Problems found by Coverity Scan.

Resolves: rhbz#756315
---
 fence/agents/ipmilan/ipmilan.c |   24 ++++++++++++++++++------
 1 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/fence/agents/ipmilan/ipmilan.c b/fence/agents/ipmilan/ipmilan.c
index 52be371..ddcc0f6 100644
--- a/fence/agents/ipmilan/ipmilan.c
+++ b/fence/agents/ipmilan/ipmilan.c
@@ -332,11 +332,11 @@ build_cmd(char *command, size_t cmdlen, struct ipmi *ipmi, int op, int nopass)
 static int
 ipmi_spawn(struct ipmi *ipmi, const char *cmd, const char *cmd_print)
 {
-	dbg_printf(ipmi, 1, "Spawning: '%s'...\n", cmd_print);
 	if (!ipmi) {
 		errno = EINVAL;
 		return -1;
 	}
+	dbg_printf(ipmi, 1, "Spawning: '%s'...\n", cmd_print);
 
 	if (ipmi->i_pid != -1)  {
 		dbg_printf(ipmi, 1, "Can't spawn: PID %d running\n",
@@ -805,19 +805,22 @@ get_options_stdin(char *ip, size_t iplen,
 		} else if (!strcasecmp(name, "lanplus")) {
 			(*lanplus) = 1;
 		} else if (!strcasecmp(name,"timeout")) {
-			if ((sscanf(val,"%d",timeout)!=1) || *timeout<1) {
+			if ((!val) || (sscanf(val,"%d",timeout)!=1) || *timeout<1) {
 			    *timeout=DEFAULT_TIMEOUT;
 			}
 		} else if (!strcasecmp(name,"power_wait")) {
-			if ((sscanf(val,"%d",power_wait)!=1) || *power_wait<1) {
+			if ((!val) || (sscanf(val,"%d",power_wait)!=1) || *power_wait<1) {
 			    *power_wait=DEFAULT_POWER_WAIT;
 			}
 		} else if (!strcasecmp(name,"cipher")) {
-			if ((sscanf(val,"%d",cipher)!=1) || *cipher<0) {
+			if ((!val) || (sscanf(val,"%d",cipher)!=1) || *cipher<0) {
 			    *cipher=-1;
 			}
 		} else if (!strcasecmp(name,"method")) {
-			strncpy (method, val, methodlen);
+			if (val)
+				strncpy (method, val, methodlen);
+			else
+				method[0] = 0;
 		} else if (!strcasecmp(name, "option") ||
 			   !strcasecmp(name, "operation") ||
 			   !strcasecmp(name, "action")) {
@@ -983,40 +986,47 @@ main(int argc, char **argv)
 			case 'A':
 				/* Auth type */
 				strncpy(authtype, optarg, sizeof(authtype));
+				authtype[sizeof(authtype)-1] = 0;
 				break;
 			case 'L':
 				/* Privilege level - ipmitool defaults
 				 * to ADMINISTRATOR if nothing is given
 				 */
 				strncpy(privlvl, optarg, sizeof(privlvl));
+				privlvl[sizeof(privlvl)-1] = 0;
 				break;
 			case 'a':
 			case 'i':
 				/* IP address */
 				strncpy(ip, optarg, sizeof(ip));
+				ip[sizeof(ip)-1] = 0;
 				break;
 			case 'l':
 				/* user / login */
 				strncpy(user, optarg, sizeof(user));
+				user[sizeof(user)-1] = 0;
 				break;
 			case 'p':
 				/* password */
 				strncpy(passwd, optarg, sizeof(passwd));
+				passwd[sizeof(passwd)-1] = 0;
 				break;
 			case 'P':
 				lanplus = 1;
 				break;
 			case 'S':
 				strncpy(pwd_script, optarg, sizeof(pwd_script));
-				pwd_script[sizeof(pwd_script) - 1] = '\0';
+				pwd_script[sizeof(pwd_script)-1] = 0;
 				break;
 			case 'o':
 				/* Operation */
 				strncpy(op, optarg, sizeof(op));
+				op[sizeof(op)-1] = 0;
 				break;
 			case 'f':
 				/* Delay */
 				strncpy(delay, optarg, sizeof(delay));
+				delay[sizeof(delay)-1] = 0;
 				break;
 			case 't':
 				/* Timeout */
@@ -1039,6 +1049,7 @@ main(int argc, char **argv)
 			case 'M':
 				/* Reboot method */
 				strncpy(method, optarg, sizeof(method));
+				method[sizeof(method)-1] = 0;
 				break;
 			case 'v':
 				verbose++;
@@ -1077,6 +1088,7 @@ main(int argc, char **argv)
 		fp = popen(pwd_script, "r");
 		if (fp != NULL) {
 			ssize_t len = fread(pwd_buf, 1, sizeof(pwd_buf), fp);
+			pwd_buf[sizeof(pwd_buf)-1] = 0;
 			if (len > 0) {
 				char *p;
 				p = strchr(pwd_buf, '\n');


More information about the cluster-commits mailing list