Add array bounds checking in h_Enumerate

When hostList is not properly NULL-terminated, the current code does
not protect from buffer overflow.  The following patch prevents buffer
overflow, prints a message, and asserts.

On our Linux hosts, we never reached the original assert, as there is
a problem handling the segfault the buffer overflow causes.

FIXES 125506

Change-Id: Ifce92c593d17050e45add9e37a7a9ed4fbc377ef
Reviewed-on: http://gerrit.openafs.org/757
Reviewed-by: Dan Hyde <drh@umich.edu>
Reviewed-by: Derrick Brashear <shadow@dementia.org>
Tested-by: Derrick Brashear <shadow@dementia.org>

diff --git a/src/viced/host.c b/src/viced/host.c
index 9bd3b6ecd88f878819e8b9e247450b9d6e761968..73085392a7978d4353745188d3e8bf5437480d44 100644 (file)
--- a/src/viced/host.c
+++ b/src/viced/host.c
@@ -1005,14 +1005,16 @@ h_Enumerate(int (*proc) (struct host*, int, void *), void *param)
        ViceLog(0, ("Failed malloc in h_Enumerate (flags)\n"));
        assert(0);
     }
-    for (count = 0, host = hostList; host; host = host->next, count++) {
+    for (count = 0, host = hostList; host && count < hostCount; host = host->next, count++) {
        list[count] = host;
        h_Hold_r(host);
     }
     if (count != hostCount) {
        ViceLog(0, ("h_Enumerate found %d of %d hosts\n", count, hostCount));
+    } else if (host != NULL) {
+       ViceLog(0, ("h_Enumerate found more than %d hosts\n", hostCount));
+       assert(0);
     }
-    assert(count <= hostCount);
     H_UNLOCK;
     for (i = 0; i < count; i++) {
        flags[i] = (*proc) (list[i], flags[i], param);