aboutsummaryrefslogtreecommitdiffstats
path: root/lib/erl_interface
diff options
context:
space:
mode:
authorMichael Santos <[email protected]>2010-08-21 22:15:01 -0400
committerBjörn Gustavsson <[email protected]>2010-08-23 16:02:39 +0200
commitada2e2f79db780f4a029e3747ef52a01db3163a6 (patch)
tree87523e9ca0348ce8473dc0885058eb81a07e30d1 /lib/erl_interface
parent7ed6bbd4e8bb88958bd45f85e3ef8af39c9f894f (diff)
downloadotp-ada2e2f79db780f4a029e3747ef52a01db3163a6.tar.gz
otp-ada2e2f79db780f4a029e3747ef52a01db3163a6.tar.bz2
otp-ada2e2f79db780f4a029e3747ef52a01db3163a6.zip
ei: prevent overflow in ei_connect_init/ei_xconnect
Check the length of the buffer before copying. ei_cnode ec; struct in_addr addr; char *node = (char *)calloc(5001, 1); (void)memset(node, 'x', 5000); ei_connect_init(&ec, node, "", 0); addr.s_addr = inet_addr("192.168.1.1"); ei_xconnect(&ec, &addr, node);
Diffstat (limited to 'lib/erl_interface')
-rw-r--r--lib/erl_interface/src/connect/ei_connect.c8
-rw-r--r--lib/erl_interface/src/epmd/epmd_port.c12
2 files changed, 18 insertions, 2 deletions
diff --git a/lib/erl_interface/src/connect/ei_connect.c b/lib/erl_interface/src/connect/ei_connect.c
index b1b79aa0e5..e191f3fbf0 100644
--- a/lib/erl_interface/src/connect/ei_connect.c
+++ b/lib/erl_interface/src/connect/ei_connect.c
@@ -502,10 +502,14 @@ int ei_connect_init(ei_cnode* ec, const char* this_node_name,
return ERL_ERROR;
}
- if (this_node_name == NULL)
+ if (this_node_name == NULL) {
sprintf(thisalivename, "c%d", (int) getpid());
- else
+ } else if (strlen(this_node_name) >= sizeof(thisalivename)) {
+ EI_TRACE_ERR0("ei_connect_init","ERROR: this_node_name too long");
+ return ERL_ERROR;
+ } else {
strcpy(thisalivename, this_node_name);
+ }
if ((hp = ei_gethostbyname(thishostname)) == 0) {
/* Looking up IP given hostname fails. We must be on a standalone
diff --git a/lib/erl_interface/src/epmd/epmd_port.c b/lib/erl_interface/src/epmd/epmd_port.c
index 663b38d2d4..cf6122fafa 100644
--- a/lib/erl_interface/src/epmd/epmd_port.c
+++ b/lib/erl_interface/src/epmd/epmd_port.c
@@ -106,6 +106,12 @@ static int ei_epmd_r3_port (struct in_addr *addr, const char *alive,
char ntoabuf[32];
#endif
+ if (len > sizeof(buf) - 3)
+ {
+ erl_errno = ERANGE;
+ return -1;
+ }
+
put16be(s,len);
put8(s,EI_EPMD_PORT_REQ);
strcpy(s,alive);
@@ -164,6 +170,12 @@ static int ei_epmd_r4_port (struct in_addr *addr, const char *alive,
#if defined(VXWORKS)
char ntoabuf[32];
#endif
+
+ if (len > sizeof(buf) - 3)
+ {
+ erl_errno = ERANGE;
+ return -1;
+ }
put16be(s,len);
put8(s,EI_EPMD_PORT2_REQ);