summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorshishir gowda <shishirng@gluster.com>2010-08-05 01:50:28 +0000
committerAnand V. Avati <avati@dev.gluster.com>2010-08-06 03:37:51 -0700
commit624eefdeaa82419307f7e91ceaea58183d2ebe10 (patch)
tree46edc223c5873ccc8b20d4e171d2517a5afbf87d
parent9dca1bc7822a71fbefb4ca161281884cdf31129b (diff)
Fix for seg fault in dict_unserialize if undersized buffers are passed
Signed-off-by: shishir gowda <shishirng@gluster.com> Signed-off-by: Anand V. Avati <avati@dev.gluster.com> BUG: 1031 (dict_unserialize crash if undersized buffers passed) URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=1031
-rw-r--r--xlators/protocol/server/src/server-protocol.c22
1 files changed, 20 insertions, 2 deletions
diff --git a/xlators/protocol/server/src/server-protocol.c b/xlators/protocol/server/src/server-protocol.c
index c4b0d47..0cfdf00 100644
--- a/xlators/protocol/server/src/server-protocol.c
+++ b/xlators/protocol/server/src/server-protocol.c
@@ -6206,6 +6206,7 @@ static call_frame_t *
get_frame_for_call (transport_t *trans, gf_hdr_common_t *hdr)
{
call_frame_t *frame = NULL;
+ int32_t ret = -1;
frame = get_frame_for_transport (trans);
@@ -6217,7 +6218,12 @@ get_frame_for_call (transport_t *trans, gf_hdr_common_t *hdr)
frame->root->gid = ntoh32 (hdr->req.gid);
frame->root->pid = ntoh32 (hdr->req.pid);
frame->root->lk_owner = ntoh64 (hdr->req.lk_owner);
- server_decode_groups (frame, hdr);
+ ret = server_decode_groups (frame, hdr);
+
+ if (ret) {
+ //FRAME_DESTROY (frame);
+ return NULL;
+ }
return frame;
}
@@ -6337,6 +6343,10 @@ protocol_server_interpret (xlator_t *this, transport_t *trans,
break;
}
frame = get_frame_for_call (trans, hdr);
+ if (!frame) {
+ ret = -1;
+ goto out;
+ }
ret = gf_fops[op] (frame, bound_xl, hdr, hdrlen, iobuf);
break;
@@ -6348,6 +6358,10 @@ protocol_server_interpret (xlator_t *this, transport_t *trans,
break;
}
frame = get_frame_for_call (trans, hdr);
+ if (!frame) {
+ ret = -1;
+ goto out;
+ }
ret = gf_mops[op] (frame, bound_xl, hdr, hdrlen, iobuf);
break;
@@ -6365,13 +6379,17 @@ protocol_server_interpret (xlator_t *this, transport_t *trans,
}
frame = get_frame_for_call (trans, hdr);
+ if (!frame) {
+ ret = -1;
+ goto out;
+ }
ret = gf_cbks[op] (frame, bound_xl, hdr, hdrlen, iobuf);
break;
default:
break;
}
-
+out:
return ret;
}