diff options
| author | Venkatesh Somyajulu <vsomyaju@redhat.com> | 2013-04-03 17:31:57 +0530 |
|---|---|---|
| committer | Anand Avati <avati@redhat.com> | 2013-04-12 00:20:30 -0700 |
| commit | 1a40438f210ecab26a8fa1e3ca8fce01cf0623dc (patch) | |
| tree | 47c8da61eae7bf8f2f1b1e91b6631a2ccd95a2a6 | |
| parent | 281d538f17f1e689fc3201515b786417cf08f9b8 (diff) | |
dict: Put "goto out" in dict_unserialize to avoid process crash
Problem:
In the dictionary serialization function, if the
[(buf + vallen) > (orig_buf + size)], then memdup is getting failed.
Fix:
Put "goto out" whenever this condition is met.
Change-Id: I8c07dd5187364ccd6ad7625e2e3907d8b56447a9
BUG: 947824
Signed-off-by: Venkatesh Somyajulu <vsomyaju@redhat.com>
Reviewed-on: http://review.gluster.org/4771
Reviewed-by: Jeff Darcy <jdarcy@redhat.com>
Tested-by: Gluster Build System <jenkins@build.gluster.com>
| -rw-r--r-- | libglusterfs/src/dict.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/libglusterfs/src/dict.c b/libglusterfs/src/dict.c index 72dd7e7aa..b017f87e5 100644 --- a/libglusterfs/src/dict.c +++ b/libglusterfs/src/dict.c @@ -2576,6 +2576,7 @@ dict_unserialize (char *orig_buf, int32_t size, dict_t **fill) "available (%lu) < required (%lu)", (long)(orig_buf + size), (long)(buf + vallen)); + goto out; } value = get_new_data (); value->len = vallen; |