60 lines
2.1 KiB
Diff
60 lines
2.1 KiB
Diff
From b29b4b4ec846861c975bfa580386d25d48eaa087 Mon Sep 17 00:00:00 2001
|
|
From: Ravishankar N <ravishankar@redhat.com>
|
|
Date: Mon, 8 Oct 2018 11:04:14 +0530
|
|
Subject: [PATCH 397/399] features/locks: add buffer overflow checks in
|
|
pl_getxattr
|
|
|
|
Problem:
|
|
A compromised client can send a variable length buffer value for the
|
|
GF_XATTR_CLRLK_CMD virtual xattr. If the length is greater than the
|
|
size of the "key" used to send the response back, locks xlator can
|
|
segfault when it tries to do a dict_set because of the buffer overflow
|
|
in strncpy of pl_getxattr().
|
|
|
|
Fix:
|
|
Perform size checks while forming the 'key'.
|
|
|
|
Note:
|
|
This fix is already there in the master branch upstream.
|
|
|
|
Also, it looks like the size PATH_MAX used for 'key' array is not really
|
|
needed since the maximum length seems to be
|
|
"strlen(glusterfs.clrlk.tentry.kblocked) + NAME_MAX" where NAME_MAX is
|
|
used for the basename value in the clear-locks CLI:
|
|
|
|
'gluster volume clear-locks VOLNAME path kind {blocked | granted | all} {inode range | entry basename | posix range}'
|
|
|
|
But that can be done some other day.
|
|
|
|
Fixes: CVE-2018-14652
|
|
BUG: 1634669
|
|
Change-Id: I101693e91f9ea2bd26cef6c0b7d82527fefcb3e2
|
|
Signed-off-by: Ravishankar N <ravishankar@redhat.com>
|
|
Reviewed-on: https://code.engineering.redhat.com/gerrit/152038
|
|
Reviewed-by: Amar Tumballi <amarts@redhat.com>
|
|
Reviewed-by: Krutika Dhananjay <kdhananj@redhat.com>
|
|
Reviewed-by: Sunil Kumar Heggodu Gopala Acharya <sheggodu@redhat.com>
|
|
---
|
|
xlators/features/locks/src/posix.c | 5 ++++-
|
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/xlators/features/locks/src/posix.c b/xlators/features/locks/src/posix.c
|
|
index 63bcf31..63f914c 100644
|
|
--- a/xlators/features/locks/src/posix.c
|
|
+++ b/xlators/features/locks/src/posix.c
|
|
@@ -1120,7 +1120,10 @@ pl_getxattr (call_frame_t *frame, xlator_t *this, loc_t *loc,
|
|
goto out;
|
|
}
|
|
|
|
- strncpy (key, name, strlen (name));
|
|
+ if (snprintf(key, sizeof(key), "%s", name) >= sizeof(key)) {
|
|
+ op_ret = -1;
|
|
+ goto out;
|
|
+ }
|
|
if (dict_set_dynstr (dict, key, lk_summary)) {
|
|
op_ret = -1;
|
|
op_errno = ENOMEM;
|
|
--
|
|
1.8.3.1
|
|
|