fence-agents: master - fence_ipmilan: Possible buffer overflow
Marek GrĂ¡c
marx at fedoraproject.org
Thu Jan 5 13:11:51 UTC 2012
Gitweb: http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=60aae6b5f0ffea8c0e4f54aecf081c770ab4d67c
Commit: 60aae6b5f0ffea8c0e4f54aecf081c770ab4d67c
Parent: f57d38bf7f4d26d9696ad95a485ac7883df2a23c
Author: Marek 'marx' Grac <mgrac at redhat.com>
AuthorDate: Thu Jan 5 14:08:42 2012 +0100
Committer: Marek 'marx' Grac <mgrac at redhat.com>
CommitterDate: Thu Jan 5 14:08:42 2012 +0100
fence_ipmilan: Possible buffer overflow
Problems found by Coverity Scan.
Resolves: rhbz#756315
---
fence/agents/ipmilan/ipmilan.c | 24 ++++++++++++++++++------
1 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/fence/agents/ipmilan/ipmilan.c b/fence/agents/ipmilan/ipmilan.c
index 52be371..ddcc0f6 100644
--- a/fence/agents/ipmilan/ipmilan.c
+++ b/fence/agents/ipmilan/ipmilan.c
@@ -332,11 +332,11 @@ build_cmd(char *command, size_t cmdlen, struct ipmi *ipmi, int op, int nopass)
static int
ipmi_spawn(struct ipmi *ipmi, const char *cmd, const char *cmd_print)
{
- dbg_printf(ipmi, 1, "Spawning: '%s'...\n", cmd_print);
if (!ipmi) {
errno = EINVAL;
return -1;
}
+ dbg_printf(ipmi, 1, "Spawning: '%s'...\n", cmd_print);
if (ipmi->i_pid != -1) {
dbg_printf(ipmi, 1, "Can't spawn: PID %d running\n",
@@ -805,19 +805,22 @@ get_options_stdin(char *ip, size_t iplen,
} else if (!strcasecmp(name, "lanplus")) {
(*lanplus) = 1;
} else if (!strcasecmp(name,"timeout")) {
- if ((sscanf(val,"%d",timeout)!=1) || *timeout<1) {
+ if ((!val) || (sscanf(val,"%d",timeout)!=1) || *timeout<1) {
*timeout=DEFAULT_TIMEOUT;
}
} else if (!strcasecmp(name,"power_wait")) {
- if ((sscanf(val,"%d",power_wait)!=1) || *power_wait<1) {
+ if ((!val) || (sscanf(val,"%d",power_wait)!=1) || *power_wait<1) {
*power_wait=DEFAULT_POWER_WAIT;
}
} else if (!strcasecmp(name,"cipher")) {
- if ((sscanf(val,"%d",cipher)!=1) || *cipher<0) {
+ if ((!val) || (sscanf(val,"%d",cipher)!=1) || *cipher<0) {
*cipher=-1;
}
} else if (!strcasecmp(name,"method")) {
- strncpy (method, val, methodlen);
+ if (val)
+ strncpy (method, val, methodlen);
+ else
+ method[0] = 0;
} else if (!strcasecmp(name, "option") ||
!strcasecmp(name, "operation") ||
!strcasecmp(name, "action")) {
@@ -983,40 +986,47 @@ main(int argc, char **argv)
case 'A':
/* Auth type */
strncpy(authtype, optarg, sizeof(authtype));
+ authtype[sizeof(authtype)-1] = 0;
break;
case 'L':
/* Privilege level - ipmitool defaults
* to ADMINISTRATOR if nothing is given
*/
strncpy(privlvl, optarg, sizeof(privlvl));
+ privlvl[sizeof(privlvl)-1] = 0;
break;
case 'a':
case 'i':
/* IP address */
strncpy(ip, optarg, sizeof(ip));
+ ip[sizeof(ip)-1] = 0;
break;
case 'l':
/* user / login */
strncpy(user, optarg, sizeof(user));
+ user[sizeof(user)-1] = 0;
break;
case 'p':
/* password */
strncpy(passwd, optarg, sizeof(passwd));
+ passwd[sizeof(passwd)-1] = 0;
break;
case 'P':
lanplus = 1;
break;
case 'S':
strncpy(pwd_script, optarg, sizeof(pwd_script));
- pwd_script[sizeof(pwd_script) - 1] = '\0';
+ pwd_script[sizeof(pwd_script)-1] = 0;
break;
case 'o':
/* Operation */
strncpy(op, optarg, sizeof(op));
+ op[sizeof(op)-1] = 0;
break;
case 'f':
/* Delay */
strncpy(delay, optarg, sizeof(delay));
+ delay[sizeof(delay)-1] = 0;
break;
case 't':
/* Timeout */
@@ -1039,6 +1049,7 @@ main(int argc, char **argv)
case 'M':
/* Reboot method */
strncpy(method, optarg, sizeof(method));
+ method[sizeof(method)-1] = 0;
break;
case 'v':
verbose++;
@@ -1077,6 +1088,7 @@ main(int argc, char **argv)
fp = popen(pwd_script, "r");
if (fp != NULL) {
ssize_t len = fread(pwd_buf, 1, sizeof(pwd_buf), fp);
+ pwd_buf[sizeof(pwd_buf)-1] = 0;
if (len > 0) {
char *p;
p = strchr(pwd_buf, '\n');
More information about the cluster-commits
mailing list