| Newsgroups |
gmane.network.spread.cvs |
| Message-ID |
<[email protected]> |
wyvern 04/12/02 18:52:17
Modified: daemon groups.c
Log:
Fix groups-state-exchange message building code, to take the
message_header into account, and hence avoid a potential 48 byte buffer
overflow. This bug was manifested as an overwrite of My.name.
Revision Changes Path
1.21 +2 -2 spread/daemon/groups.c
Index: groups.c
===================================================================
RCS file: /storage/cvsroot/spread/daemon/groups.c,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- groups.c 2 Nov 2004 01:26:12 -0000 1.20
+++ groups.c 2 Dec 2004 23:52:17 -0000 1.21
@@ -1883,7 +1883,7 @@
{
/* To have information about this group, we need to be able to fit
* its name, ID, and the number of daemons it has in this message. */
- size_needed = MAX_GROUP_NAME + sizeof(group_id) + sizeof(int16u);
+ size_needed = MAX_GROUP_NAME + sizeof(group_id) + sizeof(int16u) + Message_get_data_header_size();
if( size_needed > GROUPS_BUF_SIZE - num_bytes ) break;
memcpy( &buf[num_bytes], grp->name, MAX_GROUP_NAME );
@@ -1904,7 +1904,7 @@
* we need to be able to store its proc_id, memb_id, number of
* local members, and the private group names of its local members. */
size_needed = sizeof(int32) + sizeof(membership_id) + sizeof(int16u) +
- (dmn->MembersList.size * MAX_GROUP_NAME);
+ (dmn->MembersList.size * MAX_GROUP_NAME) + Message_get_data_header_size();
/* This requires that the number of local group members be limited. */
if( size_needed > GROUPS_BUF_SIZE - num_bytes )
{