diff options
| author | Zdenek Kabelac <zkabelac@redhat.com> | 2012-02-08 11:29:13 +0000 |
|---|---|---|
| committer | Zdenek Kabelac <zkabelac@redhat.com> | 2012-02-08 11:29:13 +0000 |
| commit | b63b77514327e7b90dcc17e3a7ae5b784d5e5ee4 (patch) | |
| tree | 1e5551aaec169dd9bee4b2ab7aeaa99943773740 /lib/mirror | |
| parent | ebc9abf6c0525df2c6ce5e210c205f014b5d4d0d (diff) | |
| download | lvm2-b63b77514327e7b90dcc17e3a7ae5b784d5e5ee4.tar.gz | |
Add boundary test for number of mirror devs and logs
As atoi may return negative value - test for both limits.
Test log_args for limits before calling alloca().
Code from dmeventd mirror plugin should probably share same code as
we have in mirrored.c.
Diffstat (limited to 'lib/mirror')
| -rw-r--r-- | lib/mirror/mirrored.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/mirror/mirrored.c b/lib/mirror/mirrored.c index e80fee6da..a20fff479 100644 --- a/lib/mirror/mirrored.c +++ b/lib/mirror/mirrored.c @@ -248,7 +248,7 @@ static int _mirrored_transient_status(struct lv_segment *seg, char *params) p += strlen(p) + 1; - if (num_devs > DEFAULT_MIRROR_MAX_IMAGES) { + if (num_devs > DEFAULT_MIRROR_MAX_IMAGES || num_devs < 0) { log_error("Unexpectedly many (%d) mirror images in %s.", num_devs, lv->name); return_0; @@ -261,14 +261,14 @@ static int _mirrored_transient_status(struct lv_segment *seg, char *params) return_0; log_argc = atoi(args[3 + num_devs]); - log_args = alloca(log_argc * sizeof(char *)); - if (log_argc > 16) { + if (log_argc > 16 || log_argc < 0) { log_error("Unexpectedly many (%d) log arguments in %s.", log_argc, lv->name); return_0; } + log_args = alloca(log_argc * sizeof(char *)); if (dm_split_words(args[3 + num_devs] + strlen(args[3 + num_devs]) + 1, log_argc, 0, log_args) < log_argc) |