[PATCH 2/3] idmapd: validate NAMETOID names within their fixed-size field

[Prabhakar Pujeri <prabhakar.pujeri@dell.com>]

imconv() limits len to IDMAP_NAMESZ - 1 and then reads
im_name[len + 1].  An unterminated name makes this read beyond im_name,
while a terminated name can be rejected based on the unrelated byte after
its NUL character.

Use strnlen() to require a terminator within im_name.  Mark an
unterminated request as invalid before returning it to the kernel.

Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
---
 utils/idmapd/idmapd.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/utils/idmapd/idmapd.c b/utils/idmapd/idmapd.c
index 5231f56d..c41ae1f0 100644
--- a/utils/idmapd/idmapd.c
+++ b/utils/idmapd/idmapd.c
@@ -767,8 +767,6 @@ nfsdcb(int UNUSED(fd), short which, void *data)
 static void
 imconv(struct idmap_client *ic, struct idmap_msg *im)
 {
-	u_int32_t len;
-
 	switch (im->im_conv) {
 	case IDMAP_CONV_IDTONAME:
 		idtonameres(im);
@@ -779,10 +777,11 @@ imconv(struct idmap_client *ic, struct idmap_msg *im)
 			    im->im_id, im->im_name);
 		break;
 	case IDMAP_CONV_NAMETOID:
-		len = strnlen(im->im_name, IDMAP_NAMESZ - 1);
 		/* Check for NULL termination just to be careful */
-		if (im->im_name[len+1] != '\0')
+		if (strnlen(im->im_name, IDMAP_NAMESZ) == IDMAP_NAMESZ) {
+			im->im_status |= IDMAP_STATUS_INVALIDMSG;
 			return;
+		}
 		nametoidres(im);
 		if (verbose > 1)
 			xlog_warn("%s %s: (%s) name \"%s\" -> id \"%d\"",
-- 
2.55.0