From mboxrd@z Thu Jan 1 00:00:00 1970 From: ccaulfield@sourceware.org Date: 19 Mar 2008 11:38:34 -0000 Subject: [Cluster-devel] Cluster Project branch, STABLE2, updated. cluster-2.02.00-20-gce3caa5 Message-ID: <20080319113834.26097.qmail@sourceware.org> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Cluster Project". http://sources.redhat.com/git/gitweb.cgi?p=cluster.git;a=commitdiff;h=ce3caa50bca9ae837f50ab7a5f7602b9a1a1401f The branch, STABLE2 has been updated via ce3caa50bca9ae837f50ab7a5f7602b9a1a1401f (commit) from 84349029e264e982d6b962ee81b13a9f13419115 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ce3caa50bca9ae837f50ab7a5f7602b9a1a1401f Author: Christine Caulfield Date: Wed Mar 19 11:37:58 2008 +0000 [CMAN] valid port number & don't use it before validation cman_send_data didn't validate the port number. This was not a great problem, but it was slightly silly. cman_start_recv_data used the port number before validation in a debug message, this could crash the server if debug is enabled and a very large port number was passed in. Signed-off-by: Christine Caulfield ----------------------------------------------------------------------- Summary of changes: cman/daemon/commands.c | 2 +- cman/daemon/daemon.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/cman/daemon/commands.c b/cman/daemon/commands.c index 4696047..b6d796a 100644 --- a/cman/daemon/commands.c +++ b/cman/daemon/commands.c @@ -809,7 +809,7 @@ static int do_cmd_bind(struct connection *con, char *cmdbuf) memcpy(&port, cmdbuf, sizeof(int)); - P_MEMB("requested bind to port %d, port_con = %p (us=%p)\n", port, port_array[port], con); + P_MEMB("requested bind to port %d, (us=%p)\n", port, con); if (port == 0 || port > 255) return -EINVAL; diff --git a/cman/daemon/daemon.c b/cman/daemon/daemon.c index 1e51a38..eded81e 100644 --- a/cman/daemon/daemon.c +++ b/cman/daemon/daemon.c @@ -271,10 +271,16 @@ static int process_client(poll_handle handle, int fd, int revent, void *data) buf += sizeof(struct sock_data_header); + if (dmsg->port > 255) { + send_status_return(con, msg->command, -EINVAL); + return 0; + } + if (dmsg->port) port = dmsg->port; else port = con->port; + ret = comms_send_message(buf, msg->length - sizeof(struct sock_data_header), port, con->port, dmsg->nodeid, hooks/post-receive -- Cluster Project