From mboxrd@z Thu Jan 1 00:00:00 1970 From: Martin Wilck Subject: [PATCH v3 03/10] libmpathpersist: fix stack overflow in mpath_format_readfullstatus() Date: Sun, 24 Jun 2018 21:09:37 +0200 Message-ID: <20180624190944.27158-4-mwilck@suse.com> References: <20180624190944.27158-1-mwilck@suse.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20180624190944.27158-1-mwilck@suse.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com To: Christophe Varoqui , Bart Van Assche , Benjamin Marzinski Cc: dm-devel@redhat.com, Martin Wilck List-Id: dm-devel.ids Some storage arrays return corrupt data in response to READ FULL STATUS PRIN commands. This may lead to stack overflow if the values aren't sanitized. Signed-off-by: Martin Wilck --- libmpathpersist/mpath_pr_ioctl.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libmpathpersist/mpath_pr_ioctl.c b/libmpathpersist/mpath_pr_ioctl.c index bcbb9691..347f21b2 100644 --- a/libmpathpersist/mpath_pr_ioctl.c +++ b/libmpathpersist/mpath_pr_ioctl.c @@ -241,6 +241,13 @@ void mpath_format_readfullstatus(struct prin_resp *pr_buff, int len, int noisy) fdesc.rtpi = get_unaligned_be16(&p[18]); tid_len_len = get_unaligned_be32(&p[20]); + if (tid_len_len + 24 + k >= additional_length) { + condlog(0, + "%s: corrupt PRIN response: status descriptor end %d exceeds length %d", + __func__, tid_len_len + k + 24, + additional_length); + tid_len_len = additional_length - k - 24; + } if (tid_len_len > 0) decode_transport_id( &fdesc, &p[24], tid_len_len); @@ -272,6 +279,8 @@ decode_transport_id(struct prin_fulldescr *fdesc, unsigned char * p, int length) break; case MPATH_PROTOCOL_ID_ISCSI: num = get_unaligned_be16(&p[2]); + if (num >= sizeof(fdesc->trnptid.iscsi_name)) + num = sizeof(fdesc->trnptid.iscsi_name); memcpy(&fdesc->trnptid.iscsi_name, &p[4], num); jump = (((num + 4) < 24) ? 24 : num + 4); break; -- 2.17.1