diff options
author | Fredrik Gustafsson <[email protected]> | 2013-08-14 14:54:34 +0200 |
---|---|---|
committer | Fredrik Gustafsson <[email protected]> | 2013-08-14 14:54:34 +0200 |
commit | 410bd502e75b22cfa355ffc11eb160360c20bd6f (patch) | |
tree | dfefc81d0501d77c8cad325939252f171fe183a4 /lib/odbc | |
parent | 43259de8309d2769e0828a35831caff592cfbd07 (diff) | |
parent | b8e5024b2d48c5375fa3dd30121724fab9676e99 (diff) | |
download | otp-410bd502e75b22cfa355ffc11eb160360c20bd6f.tar.gz otp-410bd502e75b22cfa355ffc11eb160360c20bd6f.tar.bz2 otp-410bd502e75b22cfa355ffc11eb160360c20bd6f.zip |
Merge branch 'sg/odbcserver_crash_fix/OTP-11233' into maint
* sg/odbcserver_crash_fix/OTP-11233:
Added a few input checks which prevent odbcserver crash if it's executed and supplied incorrect data to stdin. A crash example:
Diffstat (limited to 'lib/odbc')
-rw-r--r-- | lib/odbc/c_src/odbcserver.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/lib/odbc/c_src/odbcserver.c b/lib/odbc/c_src/odbcserver.c index 5730e20774..8de81a30ae 100644 --- a/lib/odbc/c_src/odbcserver.c +++ b/lib/odbc/c_src/odbcserver.c @@ -277,11 +277,15 @@ int main(void) msg = receive_erlang_port_msg(); temp = strtok(msg, ";"); + if (temp == NULL) + DO_EXIT(EXIT_STDIN_BODY); length = strlen(temp); supervisor_port = safe_malloc(length + 1); strcpy(supervisor_port, temp); temp = strtok(NULL, ";"); + if (temp == NULL) + DO_EXIT(EXIT_STDIN_BODY); length = strlen(temp); odbc_port = safe_malloc(length + 1); strcpy(odbc_port, temp); @@ -1819,12 +1823,20 @@ static byte * receive_erlang_port_msg(void) len |= lengthstr[i]; } + if (len <= 0 || len > 1024) { + DO_EXIT(EXIT_STDIN_HEADER); + } + buffer = (byte *)safe_malloc(len); if (read_exact(buffer, len) <= 0) { DO_EXIT(EXIT_STDIN_BODY); } + if (buffer[len-1] != '\0') { + DO_EXIT(EXIT_STDIN_BODY); + } + return buffer; } |