|
 |
cb8e9e |
From 4b3a43a2fd2a9daa2870d7422f124dec2480c4a3 Mon Sep 17 00:00:00 2001
|
|
|
cb8e9e |
From: Susant Palai <spalai@redhat.com>
|
|
|
cb8e9e |
Date: Thu, 4 Jun 2015 22:37:11 +0530
|
|
|
cb8e9e |
Subject: [PATCH 08/18] glusterd: Buffer overflow causing crash for glusterd
|
|
|
cb8e9e |
|
|
|
cb8e9e |
Problem: In GLUSTERD_GET_DEFRAG_PROCESS we are using PATH_MAX (4096)
|
|
|
cb8e9e |
as the max size of the input for target path, but we have allocated
|
|
|
cb8e9e |
NAME_MAX (255) size of buffer for the target.
|
|
|
cb8e9e |
|
|
|
cb8e9e |
Now this crash is not seen with source, but seen with RPMS.
|
|
|
cb8e9e |
The reason is _foritfy_fail. This check happens when _FORTIFY_SOURCE
|
|
|
cb8e9e |
flag is enabled. This option tries to figure out possible
|
|
|
cb8e9e |
overflow scenarios like the bug here and does crash the process.
|
|
|
cb8e9e |
|
|
|
cb8e9e |
BUG: 1228541
|
|
|
cb8e9e |
Change-Id: I0df5d1546761ba73e88ccbf135cb49307aa9145e
|
|
|
cb8e9e |
Signed-off-by: Susant Palai <spalai@redhat.com>
|
|
|
cb8e9e |
Reviewed-on: https://code.engineering.redhat.com/gerrit/50095
|
|
|
cb8e9e |
Reviewed-by: Raghavendra Gowdappa <rgowdapp@redhat.com>
|
|
|
cb8e9e |
Tested-by: Raghavendra Gowdappa <rgowdapp@redhat.com>
|
|
|
cb8e9e |
---
|
|
|
cb8e9e |
xlators/mgmt/glusterd/src/glusterd.h | 4 ++--
|
|
|
cb8e9e |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
cb8e9e |
|
|
|
cb8e9e |
diff --git a/xlators/mgmt/glusterd/src/glusterd.h b/xlators/mgmt/glusterd/src/glusterd.h
|
|
|
cb8e9e |
index bca7697..ab62952 100644
|
|
|
cb8e9e |
--- a/xlators/mgmt/glusterd/src/glusterd.h
|
|
|
cb8e9e |
+++ b/xlators/mgmt/glusterd/src/glusterd.h
|
|
|
cb8e9e |
@@ -599,9 +599,9 @@ typedef ssize_t (*gd_serialize_t) (struct iovec outmsg, void *args);
|
|
|
cb8e9e |
|
|
|
cb8e9e |
#define GLUSTERD_GET_DEFRAG_PROCESS(path, volinfo) do { \
|
|
|
cb8e9e |
if (volinfo->rebal.defrag_cmd == GF_DEFRAG_CMD_START_TIER) \
|
|
|
cb8e9e |
- snprintf (path, PATH_MAX, "tier"); \
|
|
|
cb8e9e |
+ snprintf (path, NAME_MAX, "tier"); \
|
|
|
cb8e9e |
else \
|
|
|
cb8e9e |
- snprintf (path, PATH_MAX, "rebalance"); \
|
|
|
cb8e9e |
+ snprintf (path, NAME_MAX, "rebalance"); \
|
|
|
cb8e9e |
} while (0)
|
|
|
cb8e9e |
|
|
|
cb8e9e |
#define GLUSTERD_GET_DEFRAG_DIR(path, volinfo, priv) do { \
|
|
|
cb8e9e |
--
|
|
|
cb8e9e |
1.9.3
|
|
|
cb8e9e |
|