diff options
| author | Michael Santos <[email protected]> | 2010-08-21 22:15:01 -0400 |
|---|---|---|
| committer | Björn Gustavsson <[email protected]> | 2010-08-23 16:02:39 +0200 |
| commit | ada2e2f79db780f4a029e3747ef52a01db3163a6 (patch) | |
| tree | 87523e9ca0348ce8473dc0885058eb81a07e30d1 /lib/erl_interface/src/connect/ei_connect.c | |
| parent | 7ed6bbd4e8bb88958bd45f85e3ef8af39c9f894f (diff) | |
| download | otp-ada2e2f79db780f4a029e3747ef52a01db3163a6.tar.gz otp-ada2e2f79db780f4a029e3747ef52a01db3163a6.tar.bz2 otp-ada2e2f79db780f4a029e3747ef52a01db3163a6.zip | |
ei: prevent overflow in ei_connect_init/ei_xconnect
Check the length of the buffer before copying.
ei_cnode ec;
struct in_addr addr;
char *node = (char *)calloc(5001, 1);
(void)memset(node, 'x', 5000);
ei_connect_init(&ec, node, "", 0);
addr.s_addr = inet_addr("192.168.1.1");
ei_xconnect(&ec, &addr, node);
Diffstat (limited to 'lib/erl_interface/src/connect/ei_connect.c')
| -rw-r--r-- | lib/erl_interface/src/connect/ei_connect.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/erl_interface/src/connect/ei_connect.c b/lib/erl_interface/src/connect/ei_connect.c index b1b79aa0e5..e191f3fbf0 100644 --- a/lib/erl_interface/src/connect/ei_connect.c +++ b/lib/erl_interface/src/connect/ei_connect.c @@ -502,10 +502,14 @@ int ei_connect_init(ei_cnode* ec, const char* this_node_name, return ERL_ERROR; } - if (this_node_name == NULL) + if (this_node_name == NULL) { sprintf(thisalivename, "c%d", (int) getpid()); - else + } else if (strlen(this_node_name) >= sizeof(thisalivename)) { + EI_TRACE_ERR0("ei_connect_init","ERROR: this_node_name too long"); + return ERL_ERROR; + } else { strcpy(thisalivename, this_node_name); + } if ((hp = ei_gethostbyname(thishostname)) == 0) { /* Looking up IP given hostname fails. We must be on a standalone |