aboutsummaryrefslogtreecommitdiffstats
path: root/lib/erl_interface/src/connect
diff options
context:
space:
mode:
authorMichael Santos <[email protected]>2010-08-21 22:15:01 -0400
committerBjörn Gustavsson <[email protected]>2010-08-23 16:02:39 +0200
commitada2e2f79db780f4a029e3747ef52a01db3163a6 (patch)
tree87523e9ca0348ce8473dc0885058eb81a07e30d1 /lib/erl_interface/src/connect
parent7ed6bbd4e8bb88958bd45f85e3ef8af39c9f894f (diff)
downloadotp-ada2e2f79db780f4a029e3747ef52a01db3163a6.tar.gz
otp-ada2e2f79db780f4a029e3747ef52a01db3163a6.tar.bz2
otp-ada2e2f79db780f4a029e3747ef52a01db3163a6.zip
ei: prevent overflow in ei_connect_init/ei_xconnect
Check the length of the buffer before copying. ei_cnode ec; struct in_addr addr; char *node = (char *)calloc(5001, 1); (void)memset(node, 'x', 5000); ei_connect_init(&ec, node, "", 0); addr.s_addr = inet_addr("192.168.1.1"); ei_xconnect(&ec, &addr, node);
Diffstat (limited to 'lib/erl_interface/src/connect')
-rw-r--r--lib/erl_interface/src/connect/ei_connect.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/erl_interface/src/connect/ei_connect.c b/lib/erl_interface/src/connect/ei_connect.c
index b1b79aa0e5..e191f3fbf0 100644
--- a/lib/erl_interface/src/connect/ei_connect.c
+++ b/lib/erl_interface/src/connect/ei_connect.c
@@ -502,10 +502,14 @@ int ei_connect_init(ei_cnode* ec, const char* this_node_name,
return ERL_ERROR;
}
- if (this_node_name == NULL)
+ if (this_node_name == NULL) {
sprintf(thisalivename, "c%d", (int) getpid());
- else
+ } else if (strlen(this_node_name) >= sizeof(thisalivename)) {
+ EI_TRACE_ERR0("ei_connect_init","ERROR: this_node_name too long");
+ return ERL_ERROR;
+ } else {
strcpy(thisalivename, this_node_name);
+ }
if ((hp = ei_gethostbyname(thishostname)) == 0) {
/* Looking up IP given hostname fails. We must be on a standalone